High 7.1Published May 6, 2026

CVE-2026-43241ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access

Updated under an hour ago (Oct 27, 2026, 3:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, This patch protects against invalid index out of bounds access to mw_sizes When invalid access print message to user that configuration is not valid.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ec0467ccbdeb69a86c8729073057bda7bce00eec before 348e1ac9ad983ed7e62de14e1daf47f1695a4ce9; from ec0467ccbdeb69a86c8729073057bda7bce00eec before ee02c4f980c91820845dd8e469ec7dc670ab6d9d; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 740945de896021b9a859e71f38f6aea72a6393cf; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 85c9daa1f8319bbb3dfee71dc6a2f969cd3b4c92; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 0e930420945106151c6eb3d7837b4e6154e9b144; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 2346856b74823a2a78109002e479a3d02526a9ce; from ec0467ccbdeb69a86c8729073057bda7bce00eec before 47ce292dd45dc689747c40603222691638919189; from ec0467ccbdeb69a86c8729073057bda7bce00eec before c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface	CNA record
linux linux_kernel linux:linux_kernel	from 4.15 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/348e1ac9ad983ed7e62de14e1daf47f1695a4ce9	patch
https://git.kernel.org/stable/c/ee02c4f980c91820845dd8e469ec7dc670ab6d9d	patch
https://git.kernel.org/stable/c/740945de896021b9a859e71f38f6aea72a6393cf	patch
https://git.kernel.org/stable/c/85c9daa1f8319bbb3dfee71dc6a2f969cd3b4c92	patch
https://git.kernel.org/stable/c/0e930420945106151c6eb3d7837b4e6154e9b144	patch
https://git.kernel.org/stable/c/2346856b74823a2a78109002e479a3d02526a9ce	patch
https://git.kernel.org/stable/c/47ce292dd45dc689747c40603222691638919189	patch
https://git.kernel.org/stable/c/c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.