High 7.1Published May 6, 2026

CVE-2026-43281mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

Updated under an hour ago (Oct 27, 2026, 8:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 1, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c before 2c7ff651ec6b660c7c96a36db9328b3232f555d8; from 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c before ec0874447895b994182a962d2fee9ef075de5efd; from 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c before 2662ed331a69c0b551f78af58f12eb629a89a36f; from 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c before 31c4c67dec3362094a6747a171a4848e98542265; 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c builds before 01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d; from 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c before 4caae8168d1b808c7d4ff481295292e3f97f90fb; from 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c before f50b39fd7c72a8734153644ee945ca0d8b2e65ab; from 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c before fcd7f96c783626c07ee3ed75fa3739a8a2052310	CNA record
linux linux_kernel linux:linux_kernel	from 3.18.1 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 3.18; 3.18; 3.18; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/2c7ff651ec6b660c7c96a36db9328b3232f555d8
https://git.kernel.org/stable/c/ec0874447895b994182a962d2fee9ef075de5efd
https://git.kernel.org/stable/c/2662ed331a69c0b551f78af58f12eb629a89a36f	patch
https://git.kernel.org/stable/c/31c4c67dec3362094a6747a171a4848e98542265	patch
https://git.kernel.org/stable/c/01d9a8c2615d436b2b30c19c1afe9fcd5726ff6d	patch
https://git.kernel.org/stable/c/4caae8168d1b808c7d4ff481295292e3f97f90fb	patch
https://git.kernel.org/stable/c/f50b39fd7c72a8734153644ee945ca0d8b2e65ab	patch
https://git.kernel.org/stable/c/fcd7f96c783626c07ee3ed75fa3739a8a2052310	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.