P4Verified

CVE-2026-43499: linux kernel from 2.6.39 (inclusive), before 6.1.175 (exclusive), from 6.2 (inclusive), before 6.6.140 (exclusive)…

CVE-2026-43499. CVSS 3.1 base score 7.8 (HIGH, Source advisory). EPSS 0.00789 (percentile 0.55232), scored 14-Oct-2026.

Affected technology

linux kernel · from 2.6.39 (inclusive), before 6.1.175 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.140 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.86 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.18.27 (exclusive)
linux

linux kernel · from 6.19 (inclusive), before 7.0.4 (exclusive)
linux

Linux · 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before f3fa3424bceb128d2be4b3745506b22844b87db7, 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd, 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before d8cce4773c2b23d819baf5abedc62f7b430e8745, 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before 8a1fc8d698ac5e5916e3082a0f74450d71f9611f, 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before 6d52dfcb2a5db86e346cf51f8fcf2071b8085166, 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before 3fb7394a837740770f0d6b4b30567e60786a63f2, 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before 88614876370aac8ad1050ad785a4c095ba17ac11, 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 to before 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349
Linux

Linux · 2.6.39
Linux

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · 0 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

Component: Not specified by the source
File: kernel/locking/rtmutex.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 15-Oct-2026 09:20 UTC

CWE: CWE-416
CCR priority: 31.4 /100 (P4)
CVSS 3.1: 7.8 /10 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · Source advisory
EPSS: 0.00789 · percentile 0.55232 · 2026-10-14
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-15 09:24:28.011626+00:00 UTC
GitHub Advisory Database · Source record · observed 2026-10-15 10:43:56.988652+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-15 09:18:22.406219+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-43499.html