{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:48:44.834Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dcache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45b06bb5ea96f75ad81d7ef446f832ea6b0026fe",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "426ef05e82ee52c8d0e95fc0808b7383d8352d73",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "ddd57ebce245f9c7e2f6902a6c087d6186d2385d",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "755b40903eff563768d4d96fd4ef51ec48adde3b",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "5718df131ab78897a9dd1f2e71c3ba732d4392af",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "277cedabb0ab86baae83fa58218be13c6d3e5526",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "lessThan": "f08fe8891c3eeb63b73f9f1f6d97aa629c821579",
              "status": "affected",
              "version": "99d263d4c5b2f541dfacb5391e22e8c91ea982a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d4c96061fddd129778ce8b70fb093aa532f422d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "be2378cbffe50ce0161f0fdee914adee98af53dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a8be8af18485f9fade90e1743d940252a39eec84",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5cf3193759f7cd1cfbeef11f5cf067bbce22e55",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.55",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.29",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.19",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dcache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndcache: Limit the minimal number of bucket to two\n\nThere is an OOB read problem on dentry_hashtable when user sets\n\u0027dhash_entries=1\u0027:\n  BUG: unable to handle page fault for address: ffff888b30b774b0\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  Oops: Oops: 0000 [#1] SMP PTI\n  RIP: 0010:__d_lookup+0x56/0x120\n   Call Trace:\n    d_lookup.cold+0x16/0x5d\n    lookup_dcache+0x27/0xf0\n    lookup_one_qstr_excl+0x2a/0x180\n    start_dirop+0x55/0xa0\n    simple_start_creating+0x8d/0xa0\n    debugfs_start_creating+0x8c/0x180\n    debugfs_create_dir+0x1d/0x1c0\n    pinctrl_init+0x6d/0x140\n    do_one_initcall+0x6d/0x3d0\n    kernel_init_freeable+0x39f/0x460\n    kernel_init+0x2a/0x260\n\nThere will be only one bucket in dentry_hashtable when dhash_entries is\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\nfollowing process will access more than one buckets(which memory region\nis not allocated) in dentry_hashtable:\n d_lookup\n  b = d_hash(hash)\n    dentry_hashtable + ((u32)hashlen \u003e\u003e d_hash_shift)\n    // The C standard defines the behavior of right shift amounts\n    // exceeding the bit width of the operand as undefined. The\n    // result of \u0027(u32)hashlen \u003e\u003e d_hash_shift\u0027 becomes \u0027hashlen\u0027,\n    // so \u0027b\u0027 will point to an unallocated memory region.\n  hlist_bl_for_each_entry_rcu(b)\n   hlist_bl_first_rcu(head)\n    h-\u003efirst  // read OOB!\n\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\nso that \u0027d_hash_shift\u0027 won\u0027t exceeds the bit width of type u32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable dcache lookup is reachable through network-facing in-kernel file servers such as nfsd via an NFS LOOKUP request that reaches nfsd_lookup_dentry(), lookup_one_unlocked(), lookup_dcache(), d_lookup(), and __d_lookup(). A local syscall path also exists, but the network NFS path is the highest reasonable vector.\nAC:L - Once the kernel is booted with the vulnerable dhash_entries=1 setting, the out-of-bounds bucket calculation is deterministic and does not require winning a race or arranging timing. Attacker-controlled lookup names can repeatedly exercise the path.\nPR:N - In a plausible exported NFS deployment using AUTH_NULL or AUTH_SYS/default export security, a remote client can issue LOOKUP requests without holding privileges on the target host. The required vulnerable boot-time hash-table setting is a target configuration precondition, not an attacker privilege.\nUI:N - Exploitation does not require a victim user to open a file or perform any interactive action. A remote request or local lookup operation is sufficient once the vulnerable configuration is present.\nS:U - The flaw affects the kernel dcache and impacts the same kernel security authority that processes the lookup. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The bug is an out-of-bounds read from the dentry_hashtable, and the bucket index can point far outside the single allocated bucket. Following the kernel CVSS guidance, this unbounded kernel OOB read is treated as high confidentiality impact.\nI:N - The demonstrated primitive is an out-of-bounds read during hash bucket traversal, with no direct or reliable arbitrary write primitive shown by the fix or surrounding code. The primary demonstrated effect is invalid memory access rather than data modification.\nA:H - The patch report shows a kernel page fault and Oops in __d_lookup(), and the condition can be triggered repeatedly by lookup operations. Kernel oops/panic or failed boot is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:44.632Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d"
        },
        {
          "url": "https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af"
        },
        {
          "url": "https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526"
        },
        {
          "url": "https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579"
        }
      ],
      "title": "dcache: Limit the minimal number of bucket to two",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43071",
    "datePublished": "2026-05-05T15:29:28.081Z",
    "dateReserved": "2026-05-01T14:12:55.982Z",
    "dateUpdated": "2026-09-08T08:48:44.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}