High 7.1Published May 6, 2026

CVE-2026-43141ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut

Updated under an hour ago (Oct 27, 2026, 8:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut Number of MW LUTs depends on NTB configuration and can be set to zero, in such scenario rounddown_pow_of_two will cause undefined behaviour and should not be performed. This patch ensures that rounddown_pow_of_two is called on valid value.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ec0467ccbdeb69a86c8729073057bda7bce00eec before d652ef399f131fcd5f8f34266167449ee7c9e5b3; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 5590cd04d6845c01a6bad985a491c58af6fb5389; from ec0467ccbdeb69a86c8729073057bda7bce00eec before a11d03d116eef138a7249202bd772c8e61915aec; from ec0467ccbdeb69a86c8729073057bda7bce00eec before d0559d07afabfddaaded6a61a16154486b956764; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 2e4d5e8d86a969318340be95470bb76e52392082; from ec0467ccbdeb69a86c8729073057bda7bce00eec before a133e3caf844a3f56b6eef89ddaa66115874f6bd; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 1a867d0d79a4a570a33f2f433919ad2bd7a27b67; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 186615f8855a0be4ee7d3fcd09a8ecc10e783b08	CNA record
linux linux_kernel linux:linux_kernel	from 4.15 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/d652ef399f131fcd5f8f34266167449ee7c9e5b3	patch
https://git.kernel.org/stable/c/5590cd04d6845c01a6bad985a491c58af6fb5389	patch
https://git.kernel.org/stable/c/a11d03d116eef138a7249202bd772c8e61915aec	patch
https://git.kernel.org/stable/c/d0559d07afabfddaaded6a61a16154486b956764	patch
https://git.kernel.org/stable/c/2e4d5e8d86a969318340be95470bb76e52392082	patch
https://git.kernel.org/stable/c/a133e3caf844a3f56b6eef89ddaa66115874f6bd	patch
https://git.kernel.org/stable/c/1a867d0d79a4a570a33f2f433919ad2bd7a27b67	patch
https://git.kernel.org/stable/c/186615f8855a0be4ee7d3fcd09a8ecc10e783b08	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.