Security readout for executives and security teams
Plain-English summary
A Linux kernel driver for the SPS30 I2C sensor used the wrong element size when reading measurements. On 64-bit systems, it could treat four-byte values as eight-byte values, creating a memory-safety risk. The supplied CVSS score is 7.8, but practical exposure appears limited to systems using the affected driver and requires local, low-privileged access.
Executive priority
Prioritize remediation for embedded, industrial, monitoring, or other Linux systems confirmed to use this driver, especially where local users are untrusted. Treat other systems as an inventory and verification task rather than an emergency. The high CVSS impact warrants timely patching, but the evidence does not support claims of widespread or active attacks.
Technical view
In sps30_i2c_read_meas(), sizeof(num) resolves to the size of size_t—eight bytes on 64-bit systems—rather than the intended four-byte __be32 measurement element. The stable fixes replace it with sizeof(*meas). The supplied CVSS vector indicates local, low-complexity exploitation by a low-privileged user without interaction, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on affected Linux releases where the SPS30 I2C driver is present and used. Network-only systems without this driver or associated hardware are less likely to be exposed. The bundle lists affected versions, but does not provide sufficiently clear fixed-version boundaries for every maintained distribution kernel.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector describes a local attack requiring low privileges, not remote unauthenticated compromise. Absence from KEV does not prove exploitation is impossible.
Researcher notes
The core issue is a type-size mismatch: sizeof(size_t) can be eight bytes while each __be32 measurement element is four. The record does not identify a CWE, demonstrate exploitability, or clarify the precise corruption mechanism. Researchers should validate architecture, driver configuration, call paths, and downstream vendor backports without assuming every listed kernel is equally reachable.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced SPS30 I2C buffer-size fix.
- Confirm the distribution's security advisory maps its kernel package to CVE-2026-43476.
- Prioritize systems that load or use the SPS30 I2C driver.
- Follow vendor guidance where fixed package versions are unclear.
Validation and detection
- Inventory kernel versions on systems that may use SPS30 I2C sensors.
- Determine whether the SPS30 I2C driver is built, loaded, or actively used.
- Verify the installed kernel includes the applicable referenced stable commit.
- After updating, confirm the new kernel is running and sensor measurements still operate correctly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43476 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9aff2e9c2927ecd9652872a43a0725f101128104CVE reference, Linux
- https://git.kernel.org/stable/c/08881d82f94deaa51800360029908863e5c4c39dCVE reference, Linux
- https://git.kernel.org/stable/c/dcdf1e92674efb6692f4ebe189e0aa9fde23a541CVE reference, Linux
- https://git.kernel.org/stable/c/2a4d111a6a34afb8bb4f118009e7728ed2ec7e10CVE reference, Linux
- https://git.kernel.org/stable/c/90e978ace598567e6e30de79805bddf37cf892acCVE reference, Linux
- https://git.kernel.org/stable/c/165f12b40901c6a7aca15796da239726ddcdc5adCVE reference, Linux
- https://git.kernel.org/stable/c/216345f98cae7fcc84f49728c67478ac00321c87CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.