PT-2026-37074 · Linux · Linux Kernel

Published 2026-05-05 · Updated 2026-06-01 · CVE-2026-43071

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds (OOB) read issue exists in the dentry hashtable when the dhash entries variable is set to 1. In this configuration, dcache init() calculates d hash shift as 32. During the execution of the d lookup() function, a right shift operation occurs where the shift amount exceeds the bit width of the operand, leading to undefined behavior. This causes the system to access an unallocated memory region when calling hlist bl for each entry rcu() and hlist bl first rcu(), resulting in a kernel page fault.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-43071

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 57

• https://cve.org/CVERecord?id=CVE-2026-43071 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43071 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43071 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43071 · Security Note
• https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43071 · Vendor Advisory
• https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579 · Patch
• https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b · Patch
• https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af · Patch
• https://ubuntu.com/security/CVE-2026-43071 · Vendor Advisory
• https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d · Patch
• https://suse.com/security/cve/CVE-2026-31714 · Note