UBUNTU-CVE-2026-43197
In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)
02 / AFFECTED SOFTWARE
Affected packages
50 explicit affected versions
6 explicit affected versions
11 explicit affected versions
6 explicit affected versions
9 explicit affected versions
44 explicit affected versions
16 explicit affected versions
12 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
24 explicit affected versions
10 explicit affected versions
38 explicit affected versions
26 explicit affected versions
7 explicit affected versions
41 explicit affected versions
13 explicit affected versions
45 explicit affected versions
35 explicit affected versions
18 explicit affected versions
46 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
53 explicit affected versions
1 explicit affected versions
21 explicit affected versions
8 explicit affected versions
16 explicit affected versions
10 explicit affected versions
19 explicit affected versions
49 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
3 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
18 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
42 explicit affected versions
16 explicit affected versions
16 explicit affected versions
28 explicit affected versions
35 explicit affected versions
10 explicit affected versions
37 explicit affected versions
10 explicit affected versions
8 explicit affected versions
13 explicit affected versions
40 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
13 explicit affected versions
26 explicit affected versions
11 explicit affected versions
13 explicit affected versions
29 explicit affected versions
13 explicit affected versions
12 explicit affected versions
42 explicit affected versions
41 explicit affected versions
8 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
21 explicit affected versions
20 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
7 explicit affected versions
16 explicit affected versions
5 explicit affected versions
10 explicit affected versions
26 explicit affected versions
40 explicit affected versions
37 explicit affected versions
48 explicit affected versions
11 explicit affected versions
8 explicit affected versions
13 explicit affected versions
47 explicit affected versions
16 explicit affected versions
51 explicit affected versions
3 explicit affected versions
7 explicit affected versions
14 explicit affected versions
51 explicit affected versions
15 explicit affected versions
18 explicit affected versions
43 explicit affected versions
12 explicit affected versions
5 explicit affected versions
27 explicit affected versions
44 explicit affected versions
8 explicit affected versions
5 explicit affected versions
8 explicit affected versions
10 explicit affected versions
7 explicit affected versions
47 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
26 explicit affected versions
12 explicit affected versions
45 explicit affected versions
37 explicit affected versions
51 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
16 explicit affected versions
11 explicit affected versions
40 explicit affected versions
19 explicit affected versions
13 explicit affected versions
7 explicit affected versions
7 explicit affected versions
4 explicit affected versions
8 explicit affected versions
1 explicit affected versions
13 explicit affected versions
43 explicit affected versions
13 explicit affected versions
4 explicit affected versions
10 explicit affected versions
8 explicit affected versions
46 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
13 explicit affected versions
11 explicit affected versions
1 explicit affected versions
20 explicit affected versions
41 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/82aec772fca2223bc5774bd9af486fd95766e578
- https://ubuntu.com/security/CVE-2026-43197
- https://ubuntu.com/security/notices/USN-8490-1
- https://ubuntu.com/security/notices/USN-8490-2
- https://ubuntu.com/security/notices/USN-8491-1
- https://ubuntu.com/security/notices/USN-8508-1
- https://ubuntu.com/security/notices/USN-8545-1
- https://ubuntu.com/security/notices/USN-8546-1
- https://ubuntu.com/security/notices/USN-8604-1
- https://ubuntu.com/security/notices/USN-8605-1
- https://ubuntu.com/security/notices/USN-8630-1
- https://ubuntu.com/security/notices/USN-8630-2
- https://ubuntu.com/security/notices/USN-8630-3
- https://www.cve.org/CVERecord?id=CVE-2026-43197