CVE-2026-43205

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43205
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43205.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-43205
Downstream
Related
Published
2026-05-06T11:28:10Z
Modified
2026-08-12T03:51:31Z
Summary
dpaa2-switch: validate num_ifs to prevent out-of-bounds write
Details

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: validate num_ifs to prevent out-of-bounds write

The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports num_ifs >= 64, the loop can write past the array bounds.

Add a bound check for num_ifs in dpaa2_switch_init().

dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all ports match the flood filter, the loop fills all 64 slots and the control interface write overflows by one entry.

The check uses >= because num_ifs == DPSW_MAX_IF is also functionally broken.

build_if_id_bitmap() silently drops any ID >= 64: if (id[i] < DPSW_MAX_IF) bmap[id[i] / 64] |= ...

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43205.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
539dda3c5d190c5088b5e57944b1b482fcb464de
Fixed
a26dda3bae469c8e4e1b1993ad33dafa32d0fc28
Fixed
a3034a8d56174dd6464c46823438f25797910a8d
Fixed
b690635d4719214892855b79ce018d4b1672ac96
Fixed
8b841fd529db9faf8bc678d429d4bf4e98b10900
Fixed
89764cf44544e943230f5e03b8c40a90da26537c
Fixed
c18493f750208eb4ff1198fc5a02786b8b2d70a6
Fixed
8a5752c6dcc085a3bfc78589925182e4e98468c5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43205.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
5.15.202
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.165
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.128
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.75
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.16
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43205.json"