CVE-2026-43274 Overview
CVE-2026-43274 is an out-of-bounds access vulnerability in the Linux kernel's Microchip Inter-Processor Communication (IPC) mailbox driver (mchp-ipc-sbi). The flaw exists in the mchp_ipc_get_cluster_aggr_irq() function, which indexes the dynamically allocated cluster_cfg array using hartid. Because hartid values may be non-contiguous or larger than the array size, the driver can read or write memory outside the allocated buffer. The fix replaces hartid with cpuid, which is guaranteed to fall within the range produced by for_each_online_cpu().
Critical Impact
Out-of-bounds memory access in a kernel mailbox driver can corrupt adjacent kernel memory or trigger kernel panics on affected RISC-V systems using the Microchip IPC driver.
Affected Products
- Linux kernel versions containing the mchp-ipc-sbi mailbox driver prior to the fix
- RISC-V platforms using Microchip Inter-Processor Communication
- Distributions shipping unpatched stable kernel branches referenced in the upstream commits
Discovery Timeline
- 2026-05-06 - CVE-2026-43274 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43274
Vulnerability Analysis
The mchp-ipc-sbi driver allocates the cluster_cfg array dynamically, sizing it based on the number of online CPUs returned during initialization. The mchp_ipc_get_cluster_aggr_irq() function then accessed entries in this array using hartid as the index. On RISC-V systems, hartid is the hardware thread identifier assigned by the platform and is not required to be sequential or bounded by the CPU count. When the kernel iterated through online CPUs and used their hartid values directly, the resulting index could exceed the allocated array length.
This condition produces an out-of-bounds read or write into kernel memory. The patched code switches to cpuid for indexing, since for_each_online_cpu() guarantees logical CPU IDs that map cleanly to the array dimensions. The defect is a classic confusion between hardware-assigned identifiers and zero-based logical indices used for array sizing.
Root Cause
The root cause is improper input validation [CWE-125 / CWE-787] when translating between platform-supplied hardware identifiers and a software-managed array. The driver assumed hartid values were dense and bounded by the online CPU count, an assumption that does not hold across all RISC-V platform configurations.
Attack Vector
Exploitation requires a system running an unpatched kernel with the affected Microchip IPC mailbox driver bound to hardware that exposes non-contiguous or large hartid values. The out-of-bounds access occurs during normal driver operation when retrieving the cluster aggregate interrupt, so triggering the condition does not require a crafted input from userspace. The impact is local to the kernel and depends on what data resides adjacent to the cluster_cfg allocation.
No verified exploitation code is available. Refer to the upstream commits 0442b62, 95438699, and f7c330a for the source-level fix.
Detection Methods for CVE-2026-43274
Indicators of Compromise
- Kernel oops or panic messages referencing mchp_ipc_get_cluster_aggr_irq or the mchp-ipc-sbi driver in dmesg or /var/log/kern.log.
- KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds access in the cluster_cfg allocation on affected RISC-V systems.
- Unexpected interrupt registration failures or driver probe errors during boot on Microchip IPC-equipped hardware.
Detection Strategies
- Inventory running kernels on RISC-V hosts and compare versions against the patched stable releases referenced in the upstream commits.
- Audit loaded kernel modules for mchp-ipc-sbi using lsmod and confirm the source kernel includes the fix.
- Enable KASAN on test builds to surface out-of-bounds access during driver initialization and runtime.
Monitoring Recommendations
- Forward kernel logs to a central log aggregation system and alert on driver-specific crash signatures.
- Track kernel package versions across the fleet through configuration management tooling.
- Monitor system uptime and unexpected reboots on RISC-V devices that load the affected driver.
How to Mitigate CVE-2026-43274
Immediate Actions Required
- Identify all systems running the mchp-ipc-sbi mailbox driver, focusing on RISC-V hardware platforms.
- Apply the upstream kernel patches from the referenced stable commits as soon as vendor builds are available.
- If patching is delayed, restrict physical and administrative access to affected devices to reduce exposure.
Patch Information
The fix is delivered through three upstream kernel commits: Kernel Git Commit 0442b62, Kernel Git Commit 95438699, and Kernel Git Commit f7c330a. The patch replaces hartid-based indexing with cpuid in mchp_ipc_get_cluster_aggr_irq(). Rebuild and deploy kernels from a stable branch that includes one of these commits.
Workarounds
- Unload the mchp-ipc-sbi module on systems where Microchip IPC is not required for operation.
- Disable the driver in kernel configuration (CONFIG_MCHP_SBI_IPC_MBOX) and rebuild on platforms that do not depend on it.
- Run vendor-supplied kernels that incorporate the fix rather than maintaining custom builds without the patch.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
