CVE-2026-43316 (GCVE-0-2026-43316)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:26 – Updated: 2026-05-11 22:22
VLAI
Title
media: solo6x10: Check for out of bounds chip_id
Summary
In the Linux kernel, the following vulnerability has been resolved: media: solo6x10: Check for out of bounds chip_id Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type (literal "1" is an "int") could end up being shifted beyond 32 bits, so instrumentation was added (and due to the double is_tw286x() call seen via inlining), Clang decides the second one must now be undefined behavior and elides the rest of the function[1]. This is a known problem with Clang (that is still being worked on), but we can avoid the entire problem by actually checking the existing max chip ID, and now there is no runtime instrumentation added at all since everything is known to be within bounds. Additionally use an unsigned value for the shift to remove the instrumentation even without the explicit bounds checking. [hverkuil: fix checkpatch warning for is_tw286x]
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < c327192ca26670cf6e588c1eeda66cd2fa97630e (git)
Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < 0b3dadada2417782a63ce32dae05bafe1c949e3f (git)
Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < 603e3859393ee2ce91393b7d05e6e56e4b66e5cd (git)
Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < 33af366211ee78e3b074ff44a16121e537e86826 (git)
Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < 5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528 (git)
Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < d29f33b2cf98e4901cd5457d1ee34062e808df73 (git)
Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < 4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116 (git)
Affected: faa4fd2a09517b39cc1f5d622453f97a59acfdac , < 0fdf6323c35a134f206dcad5babb4ff488552076 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 5.10.252 , ≤ 5.10.* (semver)
Unaffected: 5.15.202 , ≤ 5.15.* (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/solo6x10/solo6x10-tw28.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c327192ca26670cf6e588c1eeda66cd2fa97630e",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            },
            {
              "lessThan": "0b3dadada2417782a63ce32dae05bafe1c949e3f",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            },
            {
              "lessThan": "603e3859393ee2ce91393b7d05e6e56e4b66e5cd",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            },
            {
              "lessThan": "33af366211ee78e3b074ff44a16121e537e86826",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            },
            {
              "lessThan": "5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            },
            {
              "lessThan": "d29f33b2cf98e4901cd5457d1ee34062e808df73",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            },
            {
              "lessThan": "4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            },
            {
              "lessThan": "0fdf6323c35a134f206dcad5babb4ff488552076",
              "status": "affected",
              "version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/solo6x10/solo6x10-tw28.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: solo6x10: Check for out of bounds chip_id\n\nClang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type\n(literal \"1\" is an \"int\") could end up being shifted beyond 32 bits,\nso instrumentation was added (and due to the double is_tw286x() call\nseen via inlining), Clang decides the second one must now be undefined\nbehavior and elides the rest of the function[1]. This is a known problem\nwith Clang (that is still being worked on), but we can avoid the entire\nproblem by actually checking the existing max chip ID, and now there is\nno runtime instrumentation added at all since everything is known to be\nwithin bounds.\n\nAdditionally use an unsigned value for the shift to remove the\ninstrumentation even without the explicit bounds checking.\n\n[hverkuil: fix checkpatch warning for is_tw286x]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:22:12.135Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c327192ca26670cf6e588c1eeda66cd2fa97630e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b3dadada2417782a63ce32dae05bafe1c949e3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/603e3859393ee2ce91393b7d05e6e56e4b66e5cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/33af366211ee78e3b074ff44a16121e537e86826"
        },
        {
          "url": "https://git.kernel.org/stable/c/5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528"
        },
        {
          "url": "https://git.kernel.org/stable/c/d29f33b2cf98e4901cd5457d1ee34062e808df73"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fdf6323c35a134f206dcad5babb4ff488552076"
        }
      ],
      "title": "media: solo6x10: Check for out of bounds chip_id",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43316",
    "datePublished": "2026-05-08T13:26:12.217Z",
    "dateReserved": "2026-05-01T14:12:56.001Z",
    "dateUpdated": "2026-05-11T22:22:12.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43316",
      "date": "2026-05-28",
      "epss": "0.00013",
      "percentile": "0.0237"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43316\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T14:16:40.117\",\"lastModified\":\"2026-05-15T18:32:29.457\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: solo6x10: Check for out of bounds chip_id\\n\\nClang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type\\n(literal \\\"1\\\" is an \\\"int\\\") could end up being shifted beyond 32 bits,\\nso instrumentation was added (and due to the double is_tw286x() call\\nseen via inlining), Clang decides the second one must now be undefined\\nbehavior and elides the rest of the function[1]. This is a known problem\\nwith Clang (that is still being worked on), but we can avoid the entire\\nproblem by actually checking the existing max chip ID, and now there is\\nno runtime instrumentation added at all since everything is known to be\\nwithin bounds.\\n\\nAdditionally use an unsigned value for the shift to remove the\\ninstrumentation even without the explicit bounds checking.\\n\\n[hverkuil: fix checkpatch warning for is_tw286x]\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.36\",\"versionEndExcluding\":\"5.10.252\",\"matchCriteriaId\":\"B6CED9D8-5F6B-4C90-A5E0-9FBEA1262F95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.202\",\"matchCriteriaId\":\"4002FC2B-1456-4666-B240-0EBF590C4671\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.165\",\"matchCriteriaId\":\"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b3dadada2417782a63ce32dae05bafe1c949e3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0fdf6323c35a134f206dcad5babb4ff488552076\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/33af366211ee78e3b074ff44a16121e537e86826\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/603e3859393ee2ce91393b7d05e6e56e4b66e5cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c327192ca26670cf6e588c1eeda66cd2fa97630e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d29f33b2cf98e4901cd5457d1ee34062e808df73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.