CVE-2026-43205 dpaa2-switch: validate num_ifs to prevent out-of-bounds write
A missing bounds check in the dpaa2-switch driver allows out-of-bounds writes, potentially enabling code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43205?
CVE-2026-43205 is a high-severity memory corruption vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: validate num_ifs to prevent out-of-bounds write
The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports num_ifs >= 64, the loop can write past the array bounds.
Add a bound check for num_ifs in dpaa2_switch_init().
dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all ports match the flood filter, the loop fills all 64 slots and the control interface write overflows by one entry.
The check uses >= because num_ifs == DPSW_MAX_IF is also functionally broken.
build_if_id_bitmap() silently drops any ID >= 64: if (id[i] < DPSW_MAX_IF) bmap[id[i] / 64] |= ...
Weakness: CWE-787
Which versions are affected by CVE-2026-43205?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43205?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43205 being exploited?
There is no known exploitation of CVE-2026-43205 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43205, DEBIAN-CVE-2026-43205, GHSA-v2hq-m36p-4jr3, ROOT-OS-UBUNTU-2204-CVE-2026-43205, ROOT-OS-UBUNTU-2404-CVE-2026-43205, UBUNTU-CVE-2026-43205.