CVE-2026-43281

mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

State: Published
Severity: Not scored
Published: May 6, 2026
Updated: Jun 1, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 2c7ff651ec6b660c7c96a36db9328b3232f555d8Affected 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before ec0874447895b994182a962d2fee9ef075de5efdAffected 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 2662ed331a69c0b551f78af58f12eb629a89a36fAffected 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 31c4c67dec3362094a6747a171a4848e98542265Affected 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 01d9a8c2615d436b2b30c19c1afe9fcd5726ff6dAffected 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 4caae8168d1b808c7d4ff481295292e3f97f90fbAffected 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before f50b39fd7c72a8734153644ee945ca0d8b2e65abAffected 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before fcd7f96c783626c07ee3ed75fa3739a8a2052310Affected
LinuxLinux	3.18Affected before 3.18Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.16 through 6.18.Not affected 6.19.6 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 2c7ff651ec6b660c7c96a36db9328b3232f555d8Affected
2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before ec0874447895b994182a962d2fee9ef075de5efdAffected
2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 2662ed331a69c0b551f78af58f12eb629a89a36fAffected
2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 31c4c67dec3362094a6747a171a4848e98542265Affected
2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 01d9a8c2615d436b2b30c19c1afe9fcd5726ff6dAffected
2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before 4caae8168d1b808c7d4ff481295292e3f97f90fbAffected
2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before f50b39fd7c72a8734153644ee945ca0d8b2e65abAffected
2b6d83e2b8b7de82331a6a1dcd64b51020a6031c to before fcd7f96c783626c07ee3ed75fa3739a8a2052310Affected

LinuxLinux

3.18Affected
before 3.18Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.16 through 6.18.*Not affected
6.19.6 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.