PT-2026-36423 · Linux+2 · Linux+103

Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-43006

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the io uring subsystem where the validate fixed range() function allows a buffer address at the exact end of a registered region when the length is zero. This occurs because the check utilizes a strict greater-than comparison. Consequently, the io import fixed() function computes an offset equal to the registered length, causing the bvec skip logic to advance beyond the final bio vec entry and read bv offset from out-of-bounds slab memory. This can lead to a slab-out-of-bounds read in the io import reg buf() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-43006

Affected Products

Linux

Linux-Allwinner-5.19

Linux-Aws

Linux-Aws-5.0

Linux-Aws-5.11

Linux-Aws-5.13

Linux-Aws-5.19

Linux-Aws-5.3

Linux-Aws-5.8

Linux-Aws-6.14

Linux-Aws-6.17

Linux-Aws-6.2

Linux-Aws-6.5

Linux-Azure

Linux-Azure-5.11

Linux-Azure-5.13

Linux-Azure-5.19

Linux-Azure-5.3

Linux-Azure-5.8

Linux-Azure-6.11

Linux-Azure-6.17

Linux-Azure-6.2

Linux-Azure-6.5

Linux-Azure-Edge

Linux-Azure-Fde

Linux-Azure-Fde-5.19

Linux-Azure-Fde-6.17

Linux-Azure-Fde-6.2

Linux-Gcp

Linux-Gcp-5.11

Linux-Gcp-5.13

Linux-Gcp-5.19

Linux-Gcp-5.3

Linux-Gcp-5.8

Linux-Gcp-6.11

Linux-Gcp-6.14

Linux-Gcp-6.17

Linux-Gcp-6.2

Linux-Gcp-6.5

Linux-Gke

Linux-Gke-4.15

Linux-Gkeop-5.15

Linux-Gke-5.4

Linux-Gkeop

Linux-Hwe

Linux-Hwe-5.11

Linux-Hwe-5.13

Linux-Hwe-5.19

Linux-Hwe-5.8

Linux-Hwe-6.11

Linux-Hwe-6.14

Linux-Hwe-6.17

Linux-Hwe-6.2

Linux-Hwe-6.5

Linux-Hwe-Edge

Linux-Intel-5.13

Linux-Intel-Iot-Realtime

Linux-Lowlatency-Hwe-5.19

Linux-Lowlatency-Hwe-6.11

Linux-Lowlatency-Hwe-6.2

Linux-Lowlatency-Hwe-6.5

Linux-Nvidia

Linux-Nvidia-6.11

Linux-Nvidia-6.2

Linux-Nvidia-6.5

Linux-Oem

Linux-Oem-5.10

Linux-Oem-5.13

Linux-Oem-5.14

Linux-Oem-5.17

Linux-Oem-5.6

Linux-Oem-6.0

Linux-Oem-6.1

Linux-Oem-6.11

Linux-Oem-6.14

Linux-Oem-6.17

Linux-Oem-6.5

Linux-Oem-6.8

Linux-Oracle

Linux-Oracle-5.0

Linux-Oracle-5.11

Linux-Oracle-5.13

Linux-Oracle-5.3

Linux-Oracle-5.8

Linux-Oracle-6.14

Linux-Oracle-6.17

Linux-Oracle-6.5

Linux-Raspi

Linux-Raspi-Realtime

Linux-Raspi2

Linux-Realtime

Linux-Realtime-6.14

Linux-Realtime-6.17

Linux-Riscv

Linux-Riscv-5.11

Linux-Riscv-5.19

Linux-Riscv-5.8

Linux-Riscv-6.14

Linux-Riscv-6.17

Linux-Riscv-6.5

Linux-Starfive-5.19

Linux-Starfive-6.2

Linux-Starfive-6.5

Linux Kernel

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43006 · Vendor Advisory
• https://git.kernel.org/stable/c/40170fc1a79c1b2e68f09ae6aac687b7305ae6f4 · Patch
• https://git.kernel.org/stable/c/040a1e7e0e2f01851fec1dd2d96906f8636a9f75 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43006 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43006 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43006 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43006 · Vendor Advisory
• https://git.kernel.org/stable/c/111a12b422a8cfa93deabaef26fec48237163214 · Patch
• https://ubuntu.com/security/CVE-2026-43006 · Vendor Advisory
• https://git.kernel.org/linus/111a12b422a8cfa93deabaef26fec48237163214 · Note