PT-2026-37511 · Linux · Linux Kernel

Rjw · Published 2026-05-06 · Updated 2026-05-22 · CVE-2026-43171

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the cper print fw err() function where the logic fails to verify if the error record length is sufficient to handle the offset. In cases of faulty firmware, if the offset exceeds the actual record, an underflow occurs during the length -= offset operation, potentially causing the system to dump the entire memory. This can lead to significant performance degradation due to large memory dumps, unauthorized data disclosure, or a system OOPS (a kernel panic) if an unmapped memory region is accessed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-43171

OESA-2026-2416

Affected Products

Linux Kernel

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2025-68185 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-43171 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43171 · Vendor Advisory
• https://git.kernel.org/stable/c/55cc6fe5716f678f06bcb95140882dfa684464ec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-40324 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46333 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31447 · Security Note
• https://git.kernel.org/stable/c/0e09b522f2622841389c3b2f9ac4969e35c0809d · Patch
• https://git.kernel.org/stable/c/54e131db4cdffd946db890ff33ff2647053fd4f6 · Patch
• https://osv.dev/vulnerability/OESA-2026-2416 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43047 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43488 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43261 · Security Note