CVE-2026-43280: linux kernel from 6.18 (inclusive), before 6.18.16 (exclusive), from 6.19 (inclusive), before 6.19.6 (exclusive); +1…

Affected technology

linux kernel · from 6.18 (inclusive), before 6.18.16 (exclusive)
linux

linux kernel · from 6.19 (inclusive), before 6.19.6 (exclusive)
linux

Linux · ada7486c5668db542a7d361268df931aca5b726a to before ffba51100ff61792fefbae11ca38ac1987a818dd, ada7486c5668db542a7d361268df931aca5b726a to before 79f52655567a6471ff3d0d6325ede91bb14461f4, ada7486c5668db542a7d361268df931aca5b726a to before fbbe32618e97eff81577a01eb7d9adcd64a216d7
Linux

Linux · 6.18
Linux

Component: Not specified by the source
Function: performs
File: drivers/gpu/drm/xe/xe_vm_madvise.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A malicious user can trigger an out-of-bounds kernel read from the xe->pat.table array. Source advisory’s CVSS 3.1 assessment (base score 7.1/10) rates confidentiality and availability impact as high; integrity impact as none.