CVE-2026-43197 Overview
CVE-2026-43197 is an out-of-bounds read vulnerability in the Linux kernel's netconsole subsystem. The flaw exists because messages passed from the console subsystem to netconsole are not guaranteed to be NUL-terminated. After commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") moved messages out of the static printk_shared_pbufs buffer, KASAN began reporting slab-out-of-bounds reads in string+0x1f7/0x240 triggered through vsnprintf and scnprintf during netconsole_write. The issue affects kernels using the NBCON console infrastructure with netconsole enabled.
Critical Impact
An out-of-bounds read in kernel context can leak adjacent slab memory to remote netconsole receivers and may cause kernel instability when reading unmapped pages.
Affected Products
- Linux kernel builds containing commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure")
- Kernel version 6.19.0 confirmed in the KASAN report
- Systems with netconsole (netcon_ext0) enabled
Discovery Timeline
- 2026-05-06 - CVE-2026-43197 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43197
Vulnerability Analysis
The vulnerability resides in the netconsole_write path. The msg buffer received from the console subsystem is not guaranteed to be NUL-terminated. Functions such as scnprintf and the underlying vsnprintf invoke the kernel's string() formatter, which scans the input until it finds a NUL byte. When no terminator is present within the allocated region, the read crosses the slab boundary.
The KASAN trace shows a 1-byte read at ffff88813b6d4c00, located 0 bytes past a 3072-byte allocation inside a 4096-byte kmalloc-4k slab. The allocation originates from nbcon_alloc during register_console in init_netconsole. The call chain is nbcon_kthread_func → nbcon_emit_next_record → netconsole_write → scnprintf → vsnprintf → string.
Root Cause
Before the NBCON conversion, console messages were placed in printk_shared_pbufs, a static global buffer that incidentally provided trailing zero bytes, masking the lack of explicit termination. The NBCON refactor allocates a per-console buffer via nbcon_alloc, removing those trailing zeros. The netconsole driver continued to treat msg as a C string and passed it to format functions that depend on NUL termination [CWE-125].
Attack Vector
The vulnerable code path is exercised whenever the kernel emits log records to netconsole. The condition is reached through normal kernel logging activity rather than direct attacker input, but the resulting read can disclose adjacent slab memory contents over the network to whichever host receives the netconsole stream. Triggering reliably requires that the message handed to netconsole lacks a terminator, which depends on the calling printk path.
No verified public exploit code is available. The vulnerability is described in prose based on the upstream commit logs and KASAN report. See the Linux Kernel Commit Fix for the authoritative patch.
Detection Methods for CVE-2026-43197
Indicators of Compromise
- KASAN reports referencing slab-out-of-bounds in string+0x1f7/0x240 with a call trace through vsnprintf and netconsole_write.
- Kernel log entries showing the buggy address located immediately after an nbcon_alloc allocation in the kmalloc-4k cache.
- Unexpected garbage characters or truncated lines in remote netconsole receivers.
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface the out-of-bounds read at runtime.
- Audit kernel build identifiers against the upstream stable commits 3126a2f98bea, 74ab1456eaa3, and 82aec772fca2 to confirm patch presence.
- Review dmesg and centralized log pipelines for KASAN slab-out-of-bounds signatures originating from netcon_ext0 kthreads.
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on KASAN strings tied to netconsole_write or nbcon_emit_next_record.
- Monitor hosts with netconsole enabled for unexpected restarts or kthread crashes following kernel upgrades to 6.19.x.
- Track kernel package versions across the fleet to confirm rollout of the upstream stable fixes.
How to Mitigate CVE-2026-43197
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits 3126a2f98bea, 74ab1456eaa3, and 82aec772fca2 once available in your distribution.
- Inventory hosts where netconsole is loaded or enabled and prioritize those for kernel updates.
- If running pre-release or mainline 6.19.x kernels, schedule rebuilds against the patched stable tree.
Patch Information
The fix is delivered through three upstream Linux kernel commits: Linux Kernel Commit Fix, Linux Kernel Commit Update, and Linux Kernel Commit Change. The patches ensure netconsole bounds the message length explicitly rather than relying on NUL termination when formatting output.
Workarounds
- Unload the netconsole module (modprobe -r netconsole) on systems that do not require remote kernel logging.
- Avoid enabling netcon_ext0 and other extended netconsole targets on production kernels until patched packages are deployed.
- Pin kernels to versions preceding commit 7eab73b18630 only where supported by the distribution and where the NBCON conversion is not otherwise required.
# Verify whether netconsole is currently loaded and disable it
lsmod | grep -i netconsole
sudo modprobe -r netconsole
# Confirm the running kernel version
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
