CVE-2026-43071 (GCVE-0-2026-43071)

Vulnerability from cvelistv5 – Published: 2026-05-05 15:29 – Updated: 2026-08-05 12:25
VLAI
Title
dcache: Limit the minimal number of bucket to two
Summary
In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b774b0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP PTI RIP: 0010:__d_lookup+0x56/0x120 Call Trace: d_lookup.cold+0x16/0x5d lookup_dcache+0x27/0xf0 lookup_one_qstr_excl+0x2a/0x180 start_dirop+0x55/0xa0 simple_start_creating+0x8d/0xa0 debugfs_start_creating+0x8c/0x180 debugfs_create_dir+0x1d/0x1c0 pinctrl_init+0x6d/0x140 do_one_initcall+0x6d/0x3d0 kernel_init_freeable+0x39f/0x460 kernel_init+0x2a/0x260 There will be only one bucket in dentry_hashtable when dhash_entries is set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then, following process will access more than one buckets(which memory region is not allocated) in dentry_hashtable: d_lookup b = d_hash(hash) dentry_hashtable + ((u32)hashlen >> d_hash_shift) // The C standard defines the behavior of right shift amounts // exceeding the bit width of the operand as undefined. The // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen', // so 'b' will point to an unallocated memory region. hlist_bl_for_each_entry_rcu(b) hlist_bl_first_rcu(head) h->first // read OOB! Fix it by limiting the minimal number of dentry_hashtable bucket to two, so that 'd_hash_shift' won't exceeds the bit width of type u32.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 , < 45b06bb5ea96f75ad81d7ef446f832ea6b0026fe (git)
Affected: 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 , < 426ef05e82ee52c8d0e95fc0808b7383d8352d73 (git)
Affected: 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 , < ddd57ebce245f9c7e2f6902a6c087d6186d2385d (git)
Affected: 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 , < 755b40903eff563768d4d96fd4ef51ec48adde3b (git)
Affected: 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 , < 5718df131ab78897a9dd1f2e71c3ba732d4392af (git)
Affected: 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 , < 277cedabb0ab86baae83fa58218be13c6d3e5526 (git)
Affected: 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 , < f08fe8891c3eeb63b73f9f1f6d97aa629c821579 (git)
Affected: d4c96061fddd129778ce8b70fb093aa532f422d0 (git)
Affected: be2378cbffe50ce0161f0fdee914adee98af53dc (git)
Affected: a8be8af18485f9fade90e1743d940252a39eec84 (git)
Affected: b5cf3193759f7cd1cfbeef11f5cf067bbce22e55 (git)
Affected: 3.10.55 , < 3.11 (semver)
Affected: 3.12.29 , < 3.13 (semver)
Affected: 3.14.19 , < 3.15 (semver)
Affected: 3.16.3 , < 3.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.17
Unaffected: 0 , < 3.17 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.83 , ≤ 6.12.* (semver)
Unaffected: 6.18.24 , ≤ 6.18.* (semver)
Unaffected: 6.19.14 , ≤ 6.19.* (semver)
Unaffected: 7.0.1 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dcache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45b06bb5ea96f75ad81d7ef446f832ea6b0026fe",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "426ef05e82ee52c8d0e95fc0808b7383d8352d73",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "ddd57ebce245f9c7e2f6902a6c087d6186d2385d",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "755b40903eff563768d4d96fd4ef51ec48adde3b",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "5718df131ab78897a9dd1f2e71c3ba732d4392af",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "277cedabb0ab86baae83fa58218be13c6d3e5526",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "f08fe8891c3eeb63b73f9f1f6d97aa629c821579",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d4c96061fddd129778ce8b70fb093aa532f422d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "be2378cbffe50ce0161f0fdee914adee98af53dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a8be8af18485f9fade90e1743d940252a39eec84",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5cf3193759f7cd1cfbeef11f5cf067bbce22e55",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.55",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.29",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.19",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dcache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndcache: Limit the minimal number of bucket to two\n\nThere is an OOB read problem on dentry_hashtable when user sets\n\u0027dhash_entries=1\u0027:\n  BUG: unable to handle page fault for address: ffff888b30b774b0\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  Oops: Oops: 0000 [#1] SMP PTI\n  RIP: 0010:__d_lookup+0x56/0x120\n   Call Trace:\n    d_lookup.cold+0x16/0x5d\n    lookup_dcache+0x27/0xf0\n    lookup_one_qstr_excl+0x2a/0x180\n    start_dirop+0x55/0xa0\n    simple_start_creating+0x8d/0xa0\n    debugfs_start_creating+0x8c/0x180\n    debugfs_create_dir+0x1d/0x1c0\n    pinctrl_init+0x6d/0x140\n    do_one_initcall+0x6d/0x3d0\n    kernel_init_freeable+0x39f/0x460\n    kernel_init+0x2a/0x260\n\nThere will be only one bucket in dentry_hashtable when dhash_entries is\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\nfollowing process will access more than one buckets(which memory region\nis not allocated) in dentry_hashtable:\n d_lookup\n  b = d_hash(hash)\n    dentry_hashtable + ((u32)hashlen \u003e\u003e d_hash_shift)\n    // The C standard defines the behavior of right shift amounts\n    // exceeding the bit width of the operand as undefined. The\n    // result of \u0027(u32)hashlen \u003e\u003e d_hash_shift\u0027 becomes \u0027hashlen\u0027,\n    // so \u0027b\u0027 will point to an unallocated memory region.\n  hlist_bl_for_each_entry_rcu(b)\n   hlist_bl_first_rcu(head)\n    h-\u003efirst  // read OOB!\n\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\nso that \u0027d_hash_shift\u0027 won\u0027t exceeds the bit width of type u32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable dcache lookup is reachable through network-facing in-kernel file servers such as nfsd via an NFS LOOKUP request that reaches nfsd_lookup_dentry(), lookup_one_unlocked(), lookup_dcache(), d_lookup(), and __d_lookup(). A local syscall path also exists, but the network NFS path is the highest reasonable vector.\nAC:L - Once the kernel is booted with the vulnerable dhash_entries=1 setting, the out-of-bounds bucket calculation is deterministic and does not require winning a race or arranging timing. Attacker-controlled lookup names can repeatedly exercise the path.\nPR:N - In a plausible exported NFS deployment using AUTH_NULL or AUTH_SYS/default export security, a remote client can issue LOOKUP requests without holding privileges on the target host. The required vulnerable boot-time hash-table setting is a target configuration precondition, not an attacker privilege.\nUI:N - Exploitation does not require a victim user to open a file or perform any interactive action. A remote request or local lookup operation is sufficient once the vulnerable configuration is present.\nS:U - The flaw affects the kernel dcache and impacts the same kernel security authority that processes the lookup. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The bug is an out-of-bounds read from the dentry_hashtable, and the bucket index can point far outside the single allocated bucket. Following the kernel CVSS guidance, this unbounded kernel OOB read is treated as high confidentiality impact.\nI:N - The demonstrated primitive is an out-of-bounds read during hash bucket traversal, with no direct or reliable arbitrary write primitive shown by the fix or surrounding code. The primary demonstrated effect is invalid memory access rather than data modification.\nA:H - The patch report shows a kernel page fault and Oops in __d_lookup(), and the condition can be triggered repeatedly by lookup operations. Kernel oops/panic or failed boot is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:44.632Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d"
        },
        {
          "url": "https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af"
        },
        {
          "url": "https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526"
        },
        {
          "url": "https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579"
        }
      ],
      "title": "dcache: Limit the minimal number of bucket to two",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43071",
    "datePublished": "2026-05-05T15:29:28.081Z",
    "dateReserved": "2026-05-01T14:12:55.982Z",
    "dateUpdated": "2026-08-05T12:25:44.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43071",
      "date": "2026-08-19",
      "epss": "0.0039",
      "percentile": "0.32292"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43071\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-05T16:16:16.420\",\"lastModified\":\"2026-07-29T19:37:45.380\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndcache: Limit the minimal number of bucket to two\\n\\nThere is an OOB read problem on dentry_hashtable when user sets\\n\u0027dhash_entries=1\u0027:\\n  BUG: unable to handle page fault for address: ffff888b30b774b0\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  Oops: Oops: 0000 [#1] SMP PTI\\n  RIP: 0010:__d_lookup+0x56/0x120\\n   Call Trace:\\n    d_lookup.cold+0x16/0x5d\\n    lookup_dcache+0x27/0xf0\\n    lookup_one_qstr_excl+0x2a/0x180\\n    start_dirop+0x55/0xa0\\n    simple_start_creating+0x8d/0xa0\\n    debugfs_start_creating+0x8c/0x180\\n    debugfs_create_dir+0x1d/0x1c0\\n    pinctrl_init+0x6d/0x140\\n    do_one_initcall+0x6d/0x3d0\\n    kernel_init_freeable+0x39f/0x460\\n    kernel_init+0x2a/0x260\\n\\nThere will be only one bucket in dentry_hashtable when dhash_entries is\\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\\nfollowing process will access more than one buckets(which memory region\\nis not allocated) in dentry_hashtable:\\n d_lookup\\n  b = d_hash(hash)\\n    dentry_hashtable + ((u32)hashlen \u003e\u003e d_hash_shift)\\n    // The C standard defines the behavior of right shift amounts\\n    // exceeding the bit width of the operand as undefined. The\\n    // result of \u0027(u32)hashlen \u003e\u003e d_hash_shift\u0027 becomes \u0027hashlen\u0027,\\n    // so \u0027b\u0027 will point to an unallocated memory region.\\n  hlist_bl_for_each_entry_rcu(b)\\n   hlist_bl_first_rcu(head)\\n    h-\u003efirst  // read OOB!\\n\\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\\nso that \u0027d_hash_shift\u0027 won\u0027t exceeds the bit width of type u32.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/dcache.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"99d263d4c5b2f541dfacb5391e22e8c91ea982a6\",\"lessThan\":\"45b06bb5ea96f75ad81d7ef446f832ea6b0026fe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99d263d4c5b2f541dfacb5391e22e8c91ea982a6\",\"lessThan\":\"426ef05e82ee52c8d0e95fc0808b7383d8352d73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99d263d4c5b2f541dfacb5391e22e8c91ea982a6\",\"lessThan\":\"ddd57ebce245f9c7e2f6902a6c087d6186d2385d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99d263d4c5b2f541dfacb5391e22e8c91ea982a6\",\"lessThan\":\"755b40903eff563768d4d96fd4ef51ec48adde3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99d263d4c5b2f541dfacb5391e22e8c91ea982a6\",\"lessThan\":\"5718df131ab78897a9dd1f2e71c3ba732d4392af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99d263d4c5b2f541dfacb5391e22e8c91ea982a6\",\"lessThan\":\"277cedabb0ab86baae83fa58218be13c6d3e5526\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99d263d4c5b2f541dfacb5391e22e8c91ea982a6\",\"lessThan\":\"f08fe8891c3eeb63b73f9f1f6d97aa629c821579\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4c96061fddd129778ce8b70fb093aa532f422d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be2378cbffe50ce0161f0fdee914adee98af53dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a8be8af18485f9fade90e1743d940252a39eec84\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b5cf3193759f7cd1cfbeef11f5cf067bbce22e55\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.10.55\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.12.29\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.14.19\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.16.3\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/dcache.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.136\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.83\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.24\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.14\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.1\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.55\",\"versionEndExcluding\":\"3.11\",\"matchCriteriaId\":\"5A516330-2A83-4603-8C0E-BBDFEECC27E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12.29\",\"versionEndExcluding\":\"3.13\",\"matchCriteriaId\":\"25875AFE-CAEF-4D99-9B64-23F2B24C08D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14.19\",\"versionEndExcluding\":\"3.15\",\"matchCriteriaId\":\"5D53296D-7B6A-4B74-A72C-45082E6C8531\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16.3\",\"versionEndExcluding\":\"3.17\",\"matchCriteriaId\":\"F14E1ED6-C14D-476A-BC5C-ED4B577D6D9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.17.1\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"8EBFC0E0-CAF5-4E1E-9563-49D5637FEB2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.136\",\"matchCriteriaId\":\"0A0F1E9A-F127-4699-A014-9E08441C9A14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.83\",\"matchCriteriaId\":\"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.24\",\"matchCriteriaId\":\"8126B8B8-6D0B-4443-86C1-672AEE893555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.14\",\"matchCriteriaId\":\"D6A8A074-BBF4-4803-ABED-519A839435BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.0.1\",\"matchCriteriaId\":\"9B5888AB-7403-4335-89E4-21CC0B48366A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.17:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A351B03-87A0-405B-8A9B-488E173E1E3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"4223286C-F679-4FEC-B144-1C3B942BD506\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"C889AAA8-186E-433F-A31D-FF09221E1EBC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.17:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"80BC78EE-50D8-4561-A6A6-A370E72F215B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}],\"evaluatorComment\":\"\\n\"}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T13:23:24+00:00",
      "cve": "CVE-2026-43071",
      "id": "CVE-2026-43071",
      "initial_release_date": "2026-05-05T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dcache: Limit the minimal number of bucket to two",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43071.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.