Out-of-Bounds Access Vulnerability in Linux Kernel Affecting Multiple Products

CVE-2026-43274

What is CVE-2026-43274?

An out-of-bounds access vulnerability was found in the Linux kernel's mchp_ipc_get_cluster_aggr_irq function. The issue arises from the cluster_cfg array being indexed incorrectly using hartid, which can be non-contiguous. This can lead to accessing memory locations beyond the allocated bounds. The vulnerability has been addressed by changing the indexing to cpuid, ensuring that it remains within a valid range, thereby enhancing the kernel's security.

References