|
Vulnerabilities
< Back

CVE-2026-43205

Updated on 06 May 2026

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: validate num_ifs to prevent out-of-bounds write

The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports num_ifs >= 64, the loop can write past the array bounds.

Add a bound check for num_ifs in dpaa2_switch_init().

dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all ports match the flood filter, the loop fills all 64 slots and the control interface write overflows by one entry.

The check uses >= because num_ifs == DPSW_MAX_IF is also functionally broken.

build_if_id_bitmap() silently drops any ID >= 64: if (id[i] < DPSW_MAX_IF) bmap[id[i] / 64] |= …

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU , Ubuntu 20.04 ELS
Affected packages:
linux-meta @ 5.4.0 (+3 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 10 Will Not Fix
41 kernels
  • 6.12.0-55.27.1.el10_0
  • 6.12.0-55.28.1.el10_0
  • 6.12.0-55.29.1.el10_0
  • 6.12.0-55.30.1.el10_0
  • 6.12.0-55.31.1.el10_0
  • 6.12.0-55.32.1.el10_0
  • 6.12.0-55.33.1.el10_0
  • 6.12.0-55.34.1.el10_0
  • 6.12.0-55.37.1.el10_0
  • 6.12.0-55.38.1.el10_0
  • 6.12.0-55.39.1.el10_0
  • 6.12.0-55.40.1.el10_0
  • 6.12.0-55.42.1.el10_0
  • 6.12.0-55.43.1.el10_0
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-124.52.2.el10_1
  • 6.12.0-124.52.3.el10_1
  • 6.12.0-124.56.5.el10_1
  • 6.12.0-124.55.3.el10_1
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.7.4.el10_2
Debian 13 Planned —
Oracle Linux 10 Will Not Fix
36 kernels
  • 6.12.0-55.27.1.0.1.el10_0
  • 6.12.0-55.28.1.0.1.el10_0
  • 6.12.0-55.29.1.0.1.el10_0
  • 6.12.0-55.30.1.0.1.el10_0
  • 6.12.0-55.31.1.0.1.el10_0
  • 6.12.0-55.32.1.0.1.el10_0
  • 6.12.0-55.33.1.0.1.el10_0
  • 6.12.0-55.34.1.0.1.el10_0
  • 6.12.0-55.37.1.0.1.el10_0
  • 6.12.0-55.38.1.0.1.el10_0
  • 6.12.0-55.39.1.0.1.el10_0
  • 6.12.0-55.40.1.0.1.el10_0
  • 6.12.0-55.41.1.0.1.el10_0
  • 6.12.0-55.42.1.0.1.el10_0
  • 6.12.0-55.43.1.0.1.el10_0
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-211.7.3.el10_2
RHEL 10 Will Not Fix
40 kernels
  • 6.12.0-55.27.1.el10_0
  • 6.12.0-55.28.1.el10_0
  • 6.12.0-55.29.1.el10_0
  • 6.12.0-55.30.1.el10_0
  • 6.12.0-55.31.1.el10_0
  • 6.12.0-55.32.1.el10_0
  • 6.12.0-55.33.1.el10_0
  • 6.12.0-55.34.1.el10_0
  • 6.12.0-55.37.1.el10_0
  • 6.12.0-55.38.1.el10_0
  • 6.12.0-55.39.1.el10_0
  • 6.12.0-55.40.1.el10_0
  • 6.12.0-55.41.1.el10_0
  • 6.12.0-55.42.1.el10_0
  • 6.12.0-55.43.1.el10_0
  • 6.12.0-124.9.1.el10_1
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.11.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
Rocky Linux 10 Will Not Fix
28 kernels
  • 6.12.0-55.27.1.el10_0
  • 6.12.0-55.29.1.el10_0
  • 6.12.0-55.30.1.el10_0
  • 6.12.0-55.32.1.el10_0
  • 6.12.0-55.34.1.el10_0
  • 6.12.0-55.37.1.el10_0
  • 6.12.0-55.39.1.el10_0
  • 6.12.0-55.40.1.el10_0
  • 6.12.0-55.41.1.el10_0
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-211.16.1.el10_2.0.1
Ubuntu 22.04 Planned —
Ubuntu 24.04 Planned —
Ubuntu 24.04 AWS Planned —