CVE-2026-43197

Year

2026

Published

May 6, 2026

Known Affected Devices

CVSS Score

N/A

What is CVE-2026-43197?

In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)

FAQ

How severe is CVE-2026-43197?

CVE-2026-43197 has a CVSS score of N/A/10, rated as Unknown. Review the affected products list and apply vendor patches.

What does the CVSS score mean for CVE-2026-43197?

CVSS (Common Vulnerability Scoring System) rates vulnerability severity from 0.0 to 10.0. CVE-2026-43197 scores N/A/10 (Unknown). Scores 9.0–10.0 are Critical, 7.0–8.9 are High, 4.0–6.9 are Medium, and below 4.0 are Low.

Which devices are affected by CVE-2026-43197?

The list of devices confirmed to be affected by CVE-2026-43197 is shown in the "Affected Devices" section above. Check your firmware version against the vendor security advisory and apply the latest patch.

How do I fix or mitigate CVE-2026-43197?

Apply the latest firmware or software update from the vendor. Check the References section above for official advisories and patch notes. If no patch is available, consider disabling the affected feature or isolating the device from untrusted networks.