01 Record

CVE-2026-43067

ext4: handle wraparound when searching for blocks for indirect mapped blocks

CriticalPUBLISHEDCNA: Linux

CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ext4: handle wraparound when searching for blocks for indirect mapped blocks

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.50% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 42.8% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-05-05 15:23Z5 MO AGO

Last updated

2026-10-19 19:06Z9 DAYS AGO

Reserved

2026-05-01

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-822Untrusted Pointer DereferenceBase
CWE-190Integer Overflow or WraparoundBase

Data version

5.2

Document digest

4dc72517f8c6553eaada172dcd7fffdb72bdfd714b180db11a68a14a25d835ad

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux9d89b9d55e25cb340c5b4b769876edc551b7a9ff to < f89bba144938921a2249237ad04a0183ff3f8930, 1b0edd6022a3f44ce87fea9959a9310f4628fbea to < 83170a05908b6cf2fb3235d3065bf613ff866f3c, 9eea2f57d11b30049ff996ac3eff6e0dc8089e5f to < 4bec4a498ce86314d470ae6144120461f2138c29, 34c803edc0b3365a42efcf9815acab63b4cf54e0 to < 12624c5b724a81e14e532972b40d863b0de3b7d1, 321ed8d559c951e71ad2d2d69a4cf0445644e865 to < 2a368ccddfc492a0aa951e2caef2985f20e96503, 4865c768b563deff1b6a6384e74a62f143427b42 to < bb81702370fad22c06ca12b6e1648754dbc37e0f, 16fce6b6c0b247258c6c217fce5a48abf50f6964, 5.15.203 to < 5.16, 6.1.167 to < 6.1.168, 6.6.130 to < 6.6.134, 6.12.77 to < 6.12.80, 6.18.14 to < 6.18.21, 6.19.4 to < 6.19.11—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/f89bba144938921a2249237ad04a0183ff3f8930
git.kernel.orghttps://git.kernel.org/stable/c/83170a05908b6cf2fb3235d3065bf613ff866f3c
git.kernel.orghttps://git.kernel.org/stable/c/4bec4a498ce86314d470ae6144120461f2138c29
git.kernel.orghttps://git.kernel.org/stable/c/12624c5b724a81e14e532972b40d863b0de3b7d1
git.kernel.orghttps://git.kernel.org/stable/c/2a368ccddfc492a0aa951e2caef2985f20e96503
git.kernel.orghttps://git.kernel.org/stable/c/bb81702370fad22c06ca12b6e1648754dbc37e0f

07 Fixed in

Debian 14

linux
Fixed in 6.19.11-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.