Junglewise Threat Intelligence

CVE-2026-43241: Linux Kernel array index out of bounds in ntb_hw_switchtec

CVE-2026-43241 · Severity: high · CVSS 7.1 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Switchtec Non-Transparent Bridge (NTB) driver could allow a local user to cause a system crash or potentially access sensitive kernel memory. The issue occurs when the system is configured with a high number of memory windows, exceeding internal limits. This affects high-performance computing environments using Switchtec PCIe switches for inter-processor communication.

Technical details

An array-index-out-of-bounds access vulnerability (CWE-125) exists in drivers/ntb/hw/mscc/ntb_hw_switchtec.c within the switchtec_ntb_init_shared function. The root cause is a lack of bounds checking on the 'idx' variable, which is calculated based on the number of direct and Look-Up Table (LUT) memory windows (MW). If the combined number of windows exceeds the MAX_MWS constant, the driver attempts to write to an invalid index in the mw_sizes array. This can be triggered during driver initialization or reconfiguration. The fix introduces a check to ensure 'idx' does not exceed MAX_MWS, terminating the loop and logging an error if an invalid configuration is detected.

Affected products

  • Linux Linux Kernel 4.15 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: advisory: Initial CVE publication
  • 2026-03-04: patched: Fix committed to various stable kernel branches

References

Related threats