Linux Kernel up to 6.18.15/6.19.5 xe_pat_index_get_coh_mode out-of-bounds

Summaryinfo

A vulnerability described as critical has been identified in Linux Kernel up to 6.18.15/6.19.5. Affected by this vulnerability is the function xe_pat_index_get_coh_mode. The manipulation results in out-of-bounds. This vulnerability was named CVE-2026-43280. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 6.18.15/6.19.5. Affected is the function xe_pat_index_get_coh_mode. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array. The vulnerability exists because the validation in madvise_args_are_sane() directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without first checking if pat_index is within [0, xe->pat.n_entries). Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug builds, it still performs the unsafe array access in production kernels. v2(Matthew Auld) - Using array_index_nospec() to mitigate spectre attacks when the value is used v3(Matthew Auld) - Put the declarations at the start of the block (cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-43280 since 05/01/2026. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 313024 (Linux Distros Unpatched Vulnerability : CVE-2026-43280), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.16 or 6.19.6 eliminates this vulnerability. Applying the patch ffba51100ff61792fefbae11ca38ac1987a818dd/79f52655567a6471ff3d0d6325ede91bb14461f4/fbbe32618e97eff81577a01eb7d9adcd64a216d7 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (313024). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion