PT-2026-39110 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-08 · CVE-2026-43449

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds issue exists in the nvme-pci component. The problem occurs in the nvme dbbuf set() function due to an incorrect loop condition. The dev->online queues variable tracks the count of queues, where valid indices range from 0 to dev->online queues minus 1. Because the loop condition failed to properly restrict the index within this valid range, it could lead to memory access outside the allocated slab boundary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43449

Affected Products

Linux Kernel

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-43449 · Security Note
• https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e · Note
• https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71 · Note
• https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9 · Note
• https://git.kernel.org/stable/c/d7990c936e25f484b61a5adeeadc1d290a9fd16e · Note
• https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f · Note
• https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516 · Note
• https://twitter.com/CVEnew/status/2052767617769963603 · Twitter Post
• https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c · Note
• https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7 · Note