UnratedFix available
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.258, 5.15.209, 6.1.167, 6.12.77, 6.18.16, 6.19.6, 6.6.130
- CVEs
- CVE-2026-43281
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 05:29 UTC · Revision 1
Source evidence
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
core-osv · Original sourcePublished 6 May 2026, 11:29 UTC
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.
osv:CVE-2026-43281
Kernel
Fixed versions: 5.10.258, 5.15.209, 6.1.167, 6.6.130, 6.12.77, 6.18.16, 6.19.6
Complete source record
{
"id": "c2fbbee8a10ff39a3b75f48c742644cd4cbd5d3e1a4b735028322bc0c5018cfd",
"url": "https://osv.dev/vulnerability/CVE-2026-43281",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.",
"evidence": "osv:CVE-2026-43281",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.258",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.209",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.167",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.130",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.77",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.16",
"evidence": "/affected/1/ranges"
},
{
"value": "6.19.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-43281",
"aliases": [
"CVE-2026-43281"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c"
},
{
"fixed": "2c7ff651ec6b660c7c96a36db9328b3232f555d8"
},
{
"fixed": "ec0874447895b994182a962d2fee9ef075de5efd"
},
{
"fixed": "2662ed331a69c0b551f78af58f12eb629a89a36f"
},
{
"fixed": "31c4c67dec3362094a6747a171a4848e98542265"
},
{
"fixed": "01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d"
},
{
"fixed": "4caae8168d1b808c7d4ff481295292e3f97f90fb"
},
{
"fixed": "f50b39fd7c72a8734153644ee945ca0d8b2e65ab"
},
{
"fixed": "fcd7f96c783626c07ee3ed75fa3739a8a2052310"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43281.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.18.0"
},
{
"fixed": "5.10.258"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.209"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.167"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.130"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.77"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.16"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "6.19.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43281.json"
}
}
],
"modified": "2026-10-28T02:30:43.290690204Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d",
"https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f",
"https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8",
"https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265",
"https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb",
"https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd",
"https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab",
"https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43281.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-43281",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43281.json"
}
},
"related_cves": [
{
"value": "CVE-2026-43281",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 510718,
"published_at": "2026-05-06T11:29:02.278+00:00"
}