CVE-2026-43141: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
In the Linux kernel, the following vulnerability has been resolved:
ntb: ntbhwswitchtec: Fix shift-out-of-bounds for 0 mw lut
Number of MW LUTs depends on NTB configuration and can be set to zero, in such scenario rounddownpowoftwo will cause undefined behaviour and should not be performed. This patch ensures that rounddownpowoftwo is called on valid value.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's ntb_hw_switchtec driver are affected when the NTB configuration has zero memory-window lookup tables (MW LUTs). The issue is configuration-dependent rather than applying to every Linux kernel system.
What is required to trigger the vulnerability?
A local attacker with low privileges can exploit the condition without user interaction, according to the CVSS vector. The vulnerable path requires an NTB configuration in which the number of MW LUTs is zero.
What should be done if patching cannot happen immediately?
Avoid or disable NTB configurations that set the number of MW LUTs to zero until the available patch can be applied. This prevents the driver from calling rounddown_pow_of_two with an invalid zero value.