netconsole: avoid OOB reads, msg is not nul-terminated
CVE-2026-43197 · published 6 May 2026
How serious is it
- Severity: critical, CVSS score 9.1 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-43197?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: c62c0a17f9b7398022f9eebe547878033264f81f to < 68fe91df6ea822dae772fceaad0686e4f5839aec, c62c0a17f9b7398022f9eebe547878033264f81f to < 8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9, c62c0a17f9b7398022f9eebe547878033264f81f to < 3126a2f98beaec5a554a1fb31c46db1e8542665e, c62c0a17f9b7398022f9eebe547878033264f81f to < 74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58
- Linux Linux: 6.6
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
netconsole: avoid OOB reads, msg is not nul-terminated
msg passed to netconsole from the console subsystem is not guaranteed
to be nul-terminated. Before recent
commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure")
the message would be placed in printk_shared_pbufs, a static global
buffer, so KASAN had harder time catching OOB accesses. Now we see:
printk: console [netcon_ext0] enabled
BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240
Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594
CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9
Call Trace:
kasan_report+0xe4/0x120
string+0x1f7/0x240
vsnprintf+0x655/0xba0
scnprintf+0xba/0x120
netconsole_write+0x3fe/0xa10
nbcon_emit_next_record+0x46e/0x860
nbcon_kthread_func+0x623/0x750
Allocated by task 1:
nbcon_alloc+0x1ea/0x450
register_console+0x26b/0xe10
init_netconsole+0xbb0/0xda0
The buggy address belongs to the object at ffff88813b6d4000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 0 bytes to the right of
allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/68fe91df6ea822dae772fceaad0686e4f5839aec
- git.kernel.org/stable/c/8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9
- git.kernel.org/stable/c/3126a2f98beaec5a554a1fb31c46db1e8542665e
- git.kernel.org/stable/c/74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58
- git.kernel.org/stable/c/82aec772fca2223bc5774bd9af486fd95766e578
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON