CVE-2026-43281: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43281 Overview

CVE-2026-43281 is a Linux kernel vulnerability in the mailbox subsystem. The issue resides in the default translation helper fw_mbox_index_xlate(), which lacks a bounds check on the index parameter. When a device tree declares #mbox-cells = <0>; and the corresponding mailbox controller does not supply fw_xlate or of_xlate callbacks, the kernel falls back to fw_mbox_index_xlate(). Under those conditions, an out-of-bounds memory access can occur during mailbox channel resolution. The flaw has been resolved upstream through multiple stable kernel commits.

Critical Impact
An out-of-bounds access in the kernel mailbox subsystem can lead to memory disclosure, kernel instability, or denial of service when malformed #mbox-cells = <0>; device tree entries are processed.

Affected Products

Linux kernel versions containing fw_mbox_index_xlate() without bounds checking
Stable kernel branches receiving fixes via commits 01d9a8c, 2662ed3, 31c4c67, 4caae81, f50b39f, and fcd7f96
Systems whose device trees declare #mbox-cells = <0>; for mailbox controllers lacking custom of_xlate/fw_xlate callbacks

Discovery Timeline

2026-05-06 - CVE-2026-43281 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43281

Vulnerability Analysis

The Linux mailbox framework provides inter-processor communication channels between CPUs and firmware or co-processors. Device trees describe each controller using the #mbox-cells property, which specifies how many cells follow the mboxes phandle reference. Kernel guidance states this value must be at least 1, but multiple device trees in the wild declare #mbox-cells = <0>;.

When a controller does not register custom translation callbacks, the kernel uses fw_mbox_index_xlate() as the default index translator. The function indexes into the controller's channel array using a value derived from the cells, but it does not validate the index against the channel count. With zero cells, the index is unconstrained, producing an out-of-bounds read of kernel memory adjacent to the channel array.

Root Cause

The root cause is a missing bounds check inside fw_mbox_index_xlate() combined with a permissive parser that accepts #mbox-cells = <0>; despite the binding documentation requiring a minimum of 1. This maps to [CWE-125] Out-of-Bounds Read in kernel-mode code paths.

Attack Vector

Exploitation requires the presence of a malformed device tree describing a mailbox controller without fw_xlate or of_xlate operations. On affected hardware, parsing such a node during driver probe or runtime channel lookup triggers the out-of-bounds access. The condition is local and dependent on platform firmware or device tree contents shipped with the system.

No verified public exploit code is available. See the upstream patches referenced under Kernel Commit 01d9a8c and Kernel Commit fcd7f96 for the precise diff that introduces the missing bounds check.

Detection Methods for CVE-2026-43281

Indicators of Compromise

Kernel oops or panic messages referencing fw_mbox_index_xlate in the call stack
KASAN reports flagging out-of-bounds reads in drivers/mailbox/mailbox.c during driver probe
Unexpected mailbox channel binding failures or EINVAL returns from mbox_request_channel*() calls

Detection Strategies

Audit device trees and ACPI tables for #mbox-cells = <0>; declarations associated with mailbox controllers
Compare running kernel version and patch level against the stable commits listed in the advisory
Enable KASAN on test kernels to surface out-of-bounds accesses originating from mailbox translation paths

Monitoring Recommendations

Forward kernel logs to a centralized SIEM or data lake and alert on BUG:, KASAN:, or Oops: strings tied to mailbox symbols
Track package and kernel update compliance across Linux fleets to confirm patched builds are deployed
Monitor reboot patterns and crash telemetry on embedded or SoC platforms where mailbox controllers are common

How to Mitigate CVE-2026-43281

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the advisory and rebuild affected kernels
Inventory systems that consume mailbox controllers, particularly ARM and embedded SoC platforms
Validate device tree sources and overlays to ensure #mbox-cells is at least 1 per the binding documentation

Patch Information

The fix adds bounds checking inside fw_mbox_index_xlate() so that out-of-range indices are rejected before the channel array is dereferenced. Stable backports are available across multiple kernel branches. Reference commits include Kernel Commit 01d9a8c, Kernel Commit 2662ed3, Kernel Commit 31c4c67, Kernel Commit 4caae81, Kernel Commit f50b39f, and Kernel Commit fcd7f96.

Workarounds

Correct device tree sources so each mailbox controller declares #mbox-cells with a value of at least 1
For controllers requiring custom indexing, implement an of_xlate or fw_xlate callback to bypass the default translator
Disable or unbind unused mailbox controllers in environments where remediation cannot be applied immediately

bash

# Confirm the running kernel includes the fix
uname -r
grep -r "#mbox-cells" /sys/firmware/devicetree/base 2>/dev/null | grep -E "<0x0>|<0>"
# Update to a patched kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f2-)