high
8.8
CVE-2026-43112 json
fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
published 2026-05-06 6 mo ago modified 2026-10-19 20 d ago also EUVD-2026-27634
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read.
This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL.
The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.
Patch / fix
- Linux Linux 5.15.209, 6.1.175, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0
- Red Hat Red Hat Enterprise Linux 10 0:6.12.0-211.30.1.el10_2
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:6.12.0-55.95.1.el10_0
- Red Hat Red Hat Enterprise Linux 8 0:4.18.0-553.141.1.el8_10, 0:4.18.0-553.141.1.rt7.482.el8_10
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:4.18.0-372.206.1.el8_6
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:4.18.0-372.206.1.el8_6
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:4.18.0-477.158.1.el8_8
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:4.18.0-477.158.1.el8_8
- Red Hat Red Hat Enterprise Linux 9 0:5.14.0-687.22.1.el9_8
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:5.14.0-284.188.1.el9_2, 0:5.14.0-284.188.1.rt14.473.el9_2
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:5.14.0-427.145.1.el9_4
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:5.14.0-570.134.1.el9_6
- Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202608241157-0
- Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202609080414-0
- Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202609011250-0
- Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202609011112-0
- Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202608250221-0
- Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202609031320-0
- Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202608182320-0
- Red Hat Red Hat OpenShift Container Platform 4.20 4.20.9.6.202608181658-0
- Red Hat Red Hat OpenShift Container Platform 4.21 4.21.9.6.202608180431-0
- Red Hat Red Hat OpenShift Container Platform 4.22 4.22.9.8.202607152026-0
- linux Debian 12 6.1.176-1
- linux Debian 13 6.12.85-1
- linux Debian 14 6.19.14-1
debian advisories DEBIAN-CVE-2026-43112
- linux Ubuntu 22.04 LTS 5.15.0-186.196
- linux Ubuntu 24.04 LTS 6.8.0-136.136
- linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
- linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72
- linux-gke Ubuntu 22.04 LTS 5.15.0-1108.114
- linux-gke Ubuntu 24.04 LTS 6.8.0-1059.67
ubuntu advisories UBUNTU-CVE-2026-43112
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kpatch-patch-6_12_0-211_16_1 RHEL 10.2 1-8.el10_2
- kpatch-patch-5_14_0-687_10_1 RHEL 9 1-8.el9_8
- kpatch-patch-4_18_0-553_85_1 RHEL 8 1-13.el8_10
- kpatch-patch-4_18_0-553_53_1 RHEL 8 1-18.el8_10
- kpatch-patch-4_18_0-553_72_1 RHEL 8 1-15.el8_10
- kpatch-patch-4_18_0-553_109_1 RHEL 8 1-11.el8_10
- kpatch-patch-4_18_0-553_125_1 RHEL 8 1-8.el8_10
- kernel-rt RHEL 8 4.18.0-553.141.1.rt7.482.el8_10
red hat advisories RHSA-2026:62641RHSA-2026:62642RHSA-2026:62639RHSA-2026:62640RHSA-2026:62638RHSA-2026:62637
- kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.62.1
- kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.62.1
- kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.62.1
- kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.63.1
- kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.63.1
- kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.63.1
- kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.63.1
- kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.63.1
suse advisories SUSE-SU-2026:2914-1SUSE-SU-2026:2799-1SUSE-SU-2026:2722-1SUSE-SU-2026:22436-1SUSE-SU-2026:22433-1SUSE-SU-2026:22460-1
- kernel-rt AlmaLinux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel-rt-core AlmaLinux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel-rt-modules AlmaLinux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel-rt-debug-core AlmaLinux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel-rt-debug-modules AlmaLinux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel-rt-modules-extra AlmaLinux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel-rt-debug-modules-extra AlmaLinux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel AlmaLinux 8 4.18.0-553.141.1.el8_10
almalinux advisories ALSA-2026:36365ALSA-2026:36366ALSA-2026:36018ALSA-2026:34911
- kernel Rocky Linux 9 5.14.0-687.22.1.el9_8
- kernel-rt Rocky Linux 8 4.18.0-553.141.1.rt7.482.el8_10
- kernel Rocky Linux 8 4.18.0-553.141.1.el8_10.0.1
rocky linux advisories RLSA-2026:36018RLSA-2026:36365RLSA-2026:36366
- git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9 commit
- git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126 commit
- git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95 commit
- git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439 commit
- git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010 commit
- git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3 commit
- git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-43112 updated cvss 8.1
kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
-
Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 moreaffected: workaround, no fix available
-
Red Hat CodeReady Linux Builder EUS (v.9.6) libperf 5.14.0-570.134.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.134.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.134.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.134.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.134.1.el9_6fixed: vendor fix RHSA-2026:53990
-
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.22.1.el9_8, perf 5.14.0-687.22.1.el9_8, rtla 5.14.0-687.22.1.el9_8, python3-perf 5.14.0-687.22.1.el9_8, kernel-devel-matched 5.14.0-687.22.1.el9_8, kernel-64k-devel-matched 5.14.0-687.22.1.el9_8, +7 morefixed: vendor fix RHSA-2026:36018
-
Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.30.1.el10_2, perf 6.12.0-211.30.1.el10_2, rtla 6.12.0-211.30.1.el10_2, python3-perf 6.12.0-211.30.1.el10_2, kernel-devel-matched 6.12.0-211.30.1.el10_2, kernel-64k-devel-matched 6.12.0-211.30.1.el10_2, +7 morefixed: vendor fix RHSA-2026:34911
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.188.1.el9_2, rtla 5.14.0-284.188.1.el9_2, kernel-devel-matched 5.14.0-284.188.1.el9_2, kernel-64k-devel-matched 5.14.0-284.188.1.el9_2, kernel-debug-devel-matched 5.14.0-284.188.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.188.1.el9_2, +5 morefixed: vendor fix RHSA-2026:59662
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) rv 5.14.0-427.145.1.el9_4, perf 5.14.0-427.145.1.el9_4, rtla 5.14.0-427.145.1.el9_4, kernel-devel-matched 5.14.0-427.145.1.el9_4, kernel-64k-devel-matched 5.14.0-427.145.1.el9_4, kernel-debug-devel-matched 5.14.0-427.145.1.el9_4, +6 morefixed: vendor fix RHSA-2026:56573
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.95.1.el10_0, perf 6.12.0-55.95.1.el10_0, rtla 6.12.0-55.95.1.el10_0, python3-perf 6.12.0-55.95.1.el10_0, kernel-devel-matched 6.12.0-55.95.1.el10_0, kernel-64k-devel-matched 6.12.0-55.95.1.el10_0, +7 morefixed: vendor fix RHSA-2026:52764
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) rv 5.14.0-570.134.1.el9_6, perf 5.14.0-570.134.1.el9_6, rtla 5.14.0-570.134.1.el9_6, python3-perf 5.14.0-570.134.1.el9_6, kernel-devel-matched 5.14.0-570.134.1.el9_6, kernel-64k-devel-matched 5.14.0-570.134.1.el9_6, +7 morefixed: vendor fix RHSA-2026:53990
show 32 moreshow fewer
-
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.141.1.el8_10, kernel 4.18.0-553.141.1.el8_10, bpftool 4.18.0-553.141.1.el8_10, kernel-core 4.18.0-553.141.1.el8_10, kernel-tools 4.18.0-553.141.1.el8_10, python3-perf 4.18.0-553.141.1.el8_10, +20 morefixed: vendor fix RHSA-2026:36366
-
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.22.1.el9_8, kernel-64k 5.14.0-687.22.1.el9_8, kernel-core 5.14.0-687.22.1.el9_8, kernel-tools 5.14.0-687.22.1.el9_8, kernel-modules 5.14.0-687.22.1.el9_8, kernel-64k-core 5.14.0-687.22.1.el9_8, +28 morefixed: vendor fix RHSA-2026:36018
-
Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.30.1.el10_2, kernel-64k 6.12.0-211.30.1.el10_2, kernel-core 6.12.0-211.30.1.el10_2, kernel-tools 6.12.0-211.30.1.el10_2, kernel-modules 6.12.0-211.30.1.el10_2, kernel-64k-core 6.12.0-211.30.1.el10_2, +29 morefixed: vendor fix RHSA-2026:34911
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) perf 4.18.0-372.206.1.el8_6, kernel 4.18.0-372.206.1.el8_6, bpftool 4.18.0-372.206.1.el8_6, kernel-core 4.18.0-372.206.1.el8_6, kernel-tools 4.18.0-372.206.1.el8_6, python3-perf 4.18.0-372.206.1.el8_6, +8 morefixed: vendor fix RHSA-2026:53989
-
Red Hat Enterprise Linux BaseOS E4S (v.8.8) perf 4.18.0-477.158.1.el8_8, kernel 4.18.0-477.158.1.el8_8, bpftool 4.18.0-477.158.1.el8_8, kernel-core 4.18.0-477.158.1.el8_8, kernel-tools 4.18.0-477.158.1.el8_8, python3-perf 4.18.0-477.158.1.el8_8, +14 morefixed: vendor fix RHSA-2026:52649
-
Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.188.1.el9_2, kernel 5.14.0-284.188.1.el9_2, kernel-64k 5.14.0-284.188.1.el9_2, kernel-core 5.14.0-284.188.1.el9_2, kernel-tools 5.14.0-284.188.1.el9_2, python3-perf 5.14.0-284.188.1.el9_2, +33 morefixed: vendor fix RHSA-2026:59662
-
Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool 7.3.0-427.145.1.el9_4, kernel 5.14.0-427.145.1.el9_4, kernel-64k 5.14.0-427.145.1.el9_4, kernel-core 5.14.0-427.145.1.el9_4, kernel-tools 5.14.0-427.145.1.el9_4, python3-perf 5.14.0-427.145.1.el9_4, +33 morefixed: vendor fix RHSA-2026:56573
-
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.95.1.el10_0, kernel-64k 6.12.0-55.95.1.el10_0, kernel-core 6.12.0-55.95.1.el10_0, kernel-tools 6.12.0-55.95.1.el10_0, kernel-modules 6.12.0-55.95.1.el10_0, kernel-64k-core 6.12.0-55.95.1.el10_0, +27 morefixed: vendor fix RHSA-2026:52764
-
Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel 5.14.0-570.134.1.el9_6, kernel-64k 5.14.0-570.134.1.el9_6, kernel-core 5.14.0-570.134.1.el9_6, kernel-tools 5.14.0-570.134.1.el9_6, kernel-modules 5.14.0-570.134.1.el9_6, kernel-64k-core 5.14.0-570.134.1.el9_6, +32 morefixed: vendor fix RHSA-2026:53990
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) perf 4.18.0-372.206.1.el8_6, kernel 4.18.0-372.206.1.el8_6, bpftool 4.18.0-372.206.1.el8_6, kernel-core 4.18.0-372.206.1.el8_6, kernel-tools 4.18.0-372.206.1.el8_6, python3-perf 4.18.0-372.206.1.el8_6, +8 morefixed: vendor fix RHSA-2026:53989
-
Red Hat Enterprise Linux BaseOS TUS (v.8.8) perf 4.18.0-477.158.1.el8_8, kernel 4.18.0-477.158.1.el8_8, bpftool 4.18.0-477.158.1.el8_8, kernel-core 4.18.0-477.158.1.el8_8, kernel-tools 4.18.0-477.158.1.el8_8, python3-perf 4.18.0-477.158.1.el8_8, +8 morefixed: vendor fix RHSA-2026:52649
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.22.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.22.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.22.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.22.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.22.1.el9_8fixed: vendor fix RHSA-2026:36018
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.30.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.30.1.el10_2fixed: vendor fix RHSA-2026:34911
-
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.95.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.95.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.95.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.95.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.95.1.el10_0fixed: vendor fix RHSA-2026:52764
-
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.141.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.141.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.141.1.el8_10fixed: vendor fix RHSA-2026:36366
-
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-kvm 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-core 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-modules 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-debug-kvm 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-debug-core 4.18.0-553.141.1.rt7.482.el8_10, +4 morefixed: vendor fix RHSA-2026:36365
-
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.22.1.el9_8, kernel-rt-64k 5.14.0-687.22.1.el9_8, kernel-rt-core 5.14.0-687.22.1.el9_8, kernel-rt-modules 5.14.0-687.22.1.el9_8, kernel-rt-64k-core 5.14.0-687.22.1.el9_8, kernel-rt-debug-core 5.14.0-687.22.1.el9_8, +14 morefixed: vendor fix RHSA-2026:36018
-
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.30.1.el10_2, kernel-rt-64k 6.12.0-211.30.1.el10_2, kernel-rt-core 6.12.0-211.30.1.el10_2, kernel-rt-modules 6.12.0-211.30.1.el10_2, kernel-rt-64k-core 6.12.0-211.30.1.el10_2, kernel-rt-debug-core 6.12.0-211.30.1.el10_2, +14 morefixed: vendor fix RHSA-2026:34911
-
Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-core 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-modules 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-debug-core 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-modules-core 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-debug-modules 5.14.0-284.188.1.rt14.473.el9_2, +4 morefixed: vendor fix RHSA-2026:59663
-
Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt 5.14.0-427.145.1.el9_4, kernel-rt-core 5.14.0-427.145.1.el9_4, kernel-rt-modules 5.14.0-427.145.1.el9_4, kernel-rt-debug-core 5.14.0-427.145.1.el9_4, kernel-rt-modules-core 5.14.0-427.145.1.el9_4, kernel-rt-debug-modules 5.14.0-427.145.1.el9_4, +4 morefixed: vendor fix RHSA-2026:56573
-
Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.95.1.el10_0, kernel-rt-64k 6.12.0-55.95.1.el10_0, kernel-rt-core 6.12.0-55.95.1.el10_0, kernel-rt-modules 6.12.0-55.95.1.el10_0, kernel-rt-64k-core 6.12.0-55.95.1.el10_0, kernel-rt-debug-core 6.12.0-55.95.1.el10_0, +14 morefixed: vendor fix RHSA-2026:52764
-
Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt 5.14.0-570.134.1.el9_6, kernel-rt-64k 5.14.0-570.134.1.el9_6, kernel-rt-core 5.14.0-570.134.1.el9_6, kernel-rt-modules 5.14.0-570.134.1.el9_6, kernel-rt-64k-core 5.14.0-570.134.1.el9_6, kernel-rt-debug-core 5.14.0-570.134.1.el9_6, +14 morefixed: vendor fix RHSA-2026:53990
-
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.22.1.el9_8, kernel-rt-core 5.14.0-687.22.1.el9_8, kernel-rt-modules 5.14.0-687.22.1.el9_8, kernel-rt-debug-core 5.14.0-687.22.1.el9_8, kernel-rt-modules-core 5.14.0-687.22.1.el9_8, kernel-rt-debug-modules 5.14.0-687.22.1.el9_8, +4 morefixed: vendor fix RHSA-2026:36018
-
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.30.1.el10_2, kernel-rt-core 6.12.0-211.30.1.el10_2, kernel-rt-modules 6.12.0-211.30.1.el10_2, kernel-rt-debug-core 6.12.0-211.30.1.el10_2, kernel-rt-modules-core 6.12.0-211.30.1.el10_2, kernel-rt-debug-modules 6.12.0-211.30.1.el10_2, +4 morefixed: vendor fix RHSA-2026:34911
-
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-kvm 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-core 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-modules 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-debug-kvm 5.14.0-284.188.1.rt14.473.el9_2, kernel-rt-debug-core 5.14.0-284.188.1.rt14.473.el9_2, +6 morefixed: vendor fix RHSA-2026:59663
-
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt 5.14.0-427.145.1.el9_4, kernel-rt-kvm 5.14.0-427.145.1.el9_4, kernel-rt-core 5.14.0-427.145.1.el9_4, kernel-rt-modules 5.14.0-427.145.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.145.1.el9_4, kernel-rt-debug-core 5.14.0-427.145.1.el9_4, +6 morefixed: vendor fix RHSA-2026:56573
-
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.95.1.el10_0, kernel-rt-kvm 6.12.0-55.95.1.el10_0, kernel-rt-core 6.12.0-55.95.1.el10_0, kernel-rt-modules 6.12.0-55.95.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.95.1.el10_0, kernel-rt-debug-core 6.12.0-55.95.1.el10_0, +6 morefixed: vendor fix RHSA-2026:52764
-
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt 5.14.0-570.134.1.el9_6, kernel-rt-kvm 5.14.0-570.134.1.el9_6, kernel-rt-core 5.14.0-570.134.1.el9_6, kernel-rt-modules 5.14.0-570.134.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.134.1.el9_6, kernel-rt-debug-core 5.14.0-570.134.1.el9_6, +6 morefixed: vendor fix RHSA-2026:53990
-
Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-core 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-modules 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-debug-core 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-debug-modules 4.18.0-553.141.1.rt7.482.el8_10, kernel-rt-modules-extra 4.18.0-553.141.1.rt7.482.el8_10, +2 morefixed: vendor fix RHSA-2026:36365
-
Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202608241157fixed: vendor fix RHSA-2026:59831
-
Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202609080414fixed: vendor fix RHSA-2026:65839
-
Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202609011250fixed: vendor fix RHSA-2026:62409
8 more fixed, 3 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-295-16 updated cvss 8.8
Siemens SIMATIC S7-1500 TM MFP
-
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystemaffected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 24 d ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CISA ADP | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Affected products
- Linux Linux
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat OpenShift Container Platform 4.12
- Red Hat Red Hat OpenShift Container Platform 4.13
- Red Hat Red Hat OpenShift Container Platform 4.14
- Red Hat Red Hat OpenShift Container Platform 4.16
- Red Hat Red Hat OpenShift Container Platform 4.17
- Red Hat Red Hat OpenShift Container Platform 4.18
- Red Hat Red Hat OpenShift Container Platform 4.19
- Red Hat Red Hat OpenShift Container Platform 4.20
- Red Hat Red Hat OpenShift Container Platform 4.21
- Red Hat Red Hat OpenShift Container Platform 4.22
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat OpenShift Container Platform 4
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
- Technology feeds
References
- git.kernel.org /stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9
- git.kernel.org /stable/c/fbced33599653471b4581dfe1abc7b467031f126
-
git.kernel.org
/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95
patch
-
git.kernel.org
/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439
patch
-
git.kernel.org
/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010
patch
-
git.kernel.org
/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3
patch
-
git.kernel.org
/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317
patch
-
access.redhat.com
/errata/RHSA-2026:59831
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:65839
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62409
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62549
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:60019
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:65851
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:57402
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:57543
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:57457
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:40764
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:52764
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34911
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:59662
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56573
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:53990
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36018
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62642
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36366
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62637
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:53989
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:52649
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62558
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62638
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62639
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62641
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:62640
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36365
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:59663
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2026-43112
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2467015
issue-tracking
- security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-43112.json
- cert-portal.siemens.com /productcert/html/ssa-784472.html
Sources
- CVE List CVE-2026-43112
- NVD CVE-2026-43112
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.