Skip to main content
VulnerabilityPublished Updated

CVE-2026-43148: Linux kernel · powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in ca46d2092f307385a7acfb42632056570d6dbbbc : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:03 UTC

Severity
Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
CISA SSVC
Exploitation
No evidence of active exploitation and no public proof of concept
Automatable
Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact
Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch
Available – fixed in ca46d2092f307385a7acfb42632056570d6dbbbc, b265e53d9adfbb5751713185843f7188aa9dd066, 33c1c6d8a28a2761ac74b0380b2563cf546c2a3a +4

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 6 May 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2, < ca46d2092f307385a7acfb42632056570d6dbbbc
Fixed in
  • ca46d2092f307385a7acfb42632056570d6dbbbc
LinuxLinuxAffected
  • ≥ 790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2, < b265e53d9adfbb5751713185843f7188aa9dd066
Fixed in
  • b265e53d9adfbb5751713185843f7188aa9dd066
LinuxLinuxAffected
  • ≥ 790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2, < 33c1c6d8a28a2761ac74b0380b2563cf546c2a3a
Fixed in
  • 33c1c6d8a28a2761ac74b0380b2563cf546c2a3a
LinuxLinuxAffected
  • ≥ 790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2, < 9d0ca11258e7b452653d04310addfec1753de1a2
Fixed in
  • 9d0ca11258e7b452653d04310addfec1753de1a2
LinuxLinuxAffected
  • ≥ 790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2, < 9b85c8f624b0f8cf9b932f5a65dacd56a1f47a72
Fixed in
  • 9b85c8f624b0f8cf9b932f5a65dacd56a1f47a72
LinuxLinuxAffected
  • ≥ 790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2, < 8b221db0b7d24675e465e98d9326d298025a4e8d
Fixed in
  • 8b221db0b7d24675e465e98d9326d298025a4e8d

AI-suggested

A fix is available and has been applied in the Linux kernel source. Users should update to a fixed kernel version that includes the patch identified by the listed commit hashes. No additional mitigation is indicated.

Description

A vulnerability in the Linux kernel's powerpc/smp subsystem was fixed by adding a check for kcalloc() failure in the parse_thread_groups() function. Without this check, a NULL pointer dereference could occur when the return value of kcalloc() is passed to of_property_read_u32_array(). This issue affects Linux kernel version 5.11.

References

Community reviews

Loading reviews…