Vulnerability-Lookup

CVE-2026-43232 (GCVE-0-2026-43232)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26

Title

net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets

Summary

In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs when the already freed fst_card_info is accessed in fst_process_tx_work_q() or fst_process_int_work_q(). A typical race condition is depicted below: CPU 0 (cleanup) | CPU 1 (tasklet) | fst_start_xmit() fst_remove_one() | tasklet_schedule() unregister_hdlc_device()| | fst_process_tx_work_q() //handler kfree(card) //free | do_bottom_half_tx() | card-> //use The following KASAN trace was captured: ================================================================== BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 ? do_bottom_half_tx+0xb88/0xd00 kasan_report+0xb8/0xf0 ? do_bottom_half_tx+0xb88/0xd00 do_bottom_half_tx+0xb88/0xd00 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx___hrtimer_run_queues+0x10/0x10 fst_process_tx_work_q+0x67/0x90 tasklet_action_common+0x1fa/0x720 ? hrtimer_interrupt+0x31f/0x780 handle_softirqs+0x176/0x530 __irq_exit_rcu+0xab/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 41 on cpu 3 at 72.330843s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 fst_add_one+0x1a5/0x1cd0 local_pci_probe+0xdd/0x190 pci_device_probe+0x341/0x480 really_probe+0x1c6/0x6a0 __driver_probe_device+0x248/0x310 driver_probe_device+0x48/0x210 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x101/0x190 __device_attach+0x198/0x3a0 device_initial_probe+0x78/0xa0 pci_bus_add_device+0x81/0xc0 pci_bus_add_devices+0x7e/0x190 enable_slot+0x9b9/0x1130 acpiphp_check_bridge.part.0+0x2e1/0x460 acpiphp_hotplug_notify+0x36c/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... Freed by task 41 on cpu 1 at 75.138639s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x135/0x410 fst_remove_one+0x2ca/0x540 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0x364/0x530 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device+0xd/0x20 disable_slot+0x116/0x260 acpiphp_disable_and_eject_slot+0x4b/0x190 acpiphp_hotplug_notify+0x230/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800aad1000: fa fb ---truncated---

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/cac048ebfbb92d91d…
https://git.kernel.org/stable/c/086131807d119238c…
https://git.kernel.org/stable/c/ae894e47e1cd5a6bf…
https://git.kernel.org/stable/c/337d7b4112a47984e…
https://git.kernel.org/stable/c/200bdb8d367ca9b47…
https://git.kernel.org/stable/c/21d341fe514fd07e3…
https://git.kernel.org/stable/c/04edfdfdfcdefc024…
https://git.kernel.org/stable/c/bae8a5d2e759da2e0…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 51e2d1b84acac39f79cacb60e6e154ce00a9d308 , < cac048ebfbb92d91d719f74b59177cb70a7633b8 (git) Affected: 998b4e54f517961d3d75144c088a24423e003005 , < 086131807d119238cd464e5b0845e48d938dfd79 (git) Affected: bb1715a6bfb0c57a68524732a376498a2569f016 , < ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 337d7b4112a47984ee319171b75b73bab47e7924 (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 200bdb8d367ca9b478f9c56ebe56411604d55c81 (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 21d341fe514fd07e345ed264c9eee21cb2061ca2 (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 04edfdfdfcdefc02408ab670607261b0a0a9a02e (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < bae8a5d2e759da2e0cba33ab2080deee96a09373 (git) Affected: 41798a063fd4721b609e11ad839b6820f5070ca7 (git) Affected: b1fe377b43c405b169cffd1b3aa39c1dde16f3ed (git) Affected: ce9dc768767bbe73d2dd330a9075e849cb8a84d4 (git) Affected: 0c5f2c7700cb18aeab1574588d3bb9c0454bf228 (git) Affected: 024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9 (git) Affected: 5.10.163 , < 5.10.252 (semver) Affected: 5.15.86 , < 5.15.202 (semver) Affected: 6.1.2 , < 6.1.165 (semver) Affected: 4.9.337 , < 4.10 (semver) Affected: 4.14.303 , < 4.15 (semver) Affected: 4.19.270 , < 4.20 (semver) Affected: 5.4.229 , < 5.5 (semver) Affected: 6.0.16 , < 6.1 (semver)	guessed
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wan/farsync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cac048ebfbb92d91d719f74b59177cb70a7633b8",
              "status": "affected",
              "version": "51e2d1b84acac39f79cacb60e6e154ce00a9d308",
              "versionType": "git"
            },
            {
              "lessThan": "086131807d119238cd464e5b0845e48d938dfd79",
              "status": "affected",
              "version": "998b4e54f517961d3d75144c088a24423e003005",
              "versionType": "git"
            },
            {
              "lessThan": "ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc",
              "status": "affected",
              "version": "bb1715a6bfb0c57a68524732a376498a2569f016",
              "versionType": "git"
            },
            {
              "lessThan": "337d7b4112a47984ee319171b75b73bab47e7924",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "200bdb8d367ca9b478f9c56ebe56411604d55c81",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "21d341fe514fd07e345ed264c9eee21cb2061ca2",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "04edfdfdfcdefc02408ab670607261b0a0a9a02e",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "bae8a5d2e759da2e0cba33ab2080deee96a09373",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "41798a063fd4721b609e11ad839b6820f5070ca7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1fe377b43c405b169cffd1b3aa39c1dde16f3ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce9dc768767bbe73d2dd330a9075e849cb8a84d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c5f2c7700cb18aeab1574588d3bb9c0454bf228",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.252",
              "status": "affected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.202",
              "status": "affected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.165",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wan/farsync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.10.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.15.86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "6.1.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.337",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.303",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.270",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.229",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-\u003e //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  \u003cIRQ\u003e\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff88800aad1000: fa fb\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable tasklets can be queued by received frames/interrupts from a remote peer on the FarSync HDLC/WAN network link. The required device detach is accounted for under UI.\nAC:L - An attacker can keep RX/interrupt work pending by continuously sending traffic, and the bug is an unsynchronized tasklet teardown rather than a condition requiring special memory layout. The race is therefore reasonably triggerable during detach.\nPR:N - The remote peer does not need local privileges or authentication to generate receive interrupts that queue the vulnerable work. Administrative privilege is only needed for the victim-side detach action, not for the attacker\u2019s network input.\nUI:R - The remote attack scenario requires another user or administrator to detach, unbind, hot-unplug, or unload the FarSync device while tasklet work is pending. Without that detach path, the freed-card use-after-free is not reached.\nS:U - The bug is within a kernel device driver and impacts kernel memory in the same security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - This is a slab use-after-free of the kmalloc-1k fst_card_info object, whose stale pointers and state are dereferenced by tasklet handlers. Kernel UAFs can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The freed card object controls subsequent I/O, DMA/status updates, queue handling, and netdev/port state accesses. As kernel UAF memory corruption, it can plausibly be shaped into write/control-flow corruption, so integrity impact is High.\nA:H - The reported KASAN trace shows a slab-use-after-free in softirq/tasklet context, which can crash or panic the kernel. Repeated triggering during detach can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:45.086Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"
        },
        {
          "url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"
        },
        {
          "url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"
        },
        {
          "url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"
        }
      ],
      "title": "net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43232",
    "datePublished": "2026-05-06T11:28:28.910Z",
    "dateReserved": "2026-05-01T14:12:55.995Z",
    "dateUpdated": "2026-08-05T12:26:45.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43232",
      "date": "2026-09-16",
      "epss": "0.00387",
      "percentile": "0.32412"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43232\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:43.223\",\"lastModified\":\"2026-06-17T10:49:12.157\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\\n\\nWhen the FarSync T-series card is being detached, the fst_card_info is\\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\\nmay still be running or pending, leading to use-after-free bugs when the\\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\\nfst_process_int_work_q().\\n\\nA typical race condition is depicted below:\\n\\nCPU 0 (cleanup)           | CPU 1 (tasklet)\\n                          | fst_start_xmit()\\nfst_remove_one()          |   tasklet_schedule()\\n  unregister_hdlc_device()|\\n                          | fst_process_tx_work_q() //handler\\n  kfree(card) //free      |   do_bottom_half_tx()\\n                          |     card-\u003e //use\\n\\nThe following KASAN trace was captured:\\n\\n==================================================================\\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\\n ...\\n Call Trace:\\n  \u003cIRQ\u003e\\n  dump_stack_lvl+0x55/0x70\\n  print_report+0xcb/0x5d0\\n  ? do_bottom_half_tx+0xb88/0xd00\\n  kasan_report+0xb8/0xf0\\n  ? do_bottom_half_tx+0xb88/0xd00\\n  do_bottom_half_tx+0xb88/0xd00\\n  ? _raw_spin_lock_irqsave+0x85/0xe0\\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  ? __pfx___hrtimer_run_queues+0x10/0x10\\n  fst_process_tx_work_q+0x67/0x90\\n  tasklet_action_common+0x1fa/0x720\\n  ? hrtimer_interrupt+0x31f/0x780\\n  handle_softirqs+0x176/0x530\\n  __irq_exit_rcu+0xab/0xe0\\n  sysvec_apic_timer_interrupt+0x70/0x80\\n ...\\n\\n Allocated by task 41 on cpu 3 at 72.330843s:\\n  kasan_save_stack+0x24/0x50\\n  kasan_save_track+0x17/0x60\\n  __kasan_kmalloc+0x7f/0x90\\n  fst_add_one+0x1a5/0x1cd0\\n  local_pci_probe+0xdd/0x190\\n  pci_device_probe+0x341/0x480\\n  really_probe+0x1c6/0x6a0\\n  __driver_probe_device+0x248/0x310\\n  driver_probe_device+0x48/0x210\\n  __device_attach_driver+0x160/0x320\\n  bus_for_each_drv+0x101/0x190\\n  __device_attach+0x198/0x3a0\\n  device_initial_probe+0x78/0xa0\\n  pci_bus_add_device+0x81/0xc0\\n  pci_bus_add_devices+0x7e/0x190\\n  enable_slot+0x9b9/0x1130\\n  acpiphp_check_bridge.part.0+0x2e1/0x460\\n  acpiphp_hotplug_notify+0x36c/0x3c0\\n  acpi_device_hotplug+0x203/0xb10\\n  acpi_hotplug_work_fn+0x59/0x80\\n ...\\n\\n Freed by task 41 on cpu 1 at 75.138639s:\\n  kasan_save_stack+0x24/0x50\\n  kasan_save_track+0x17/0x60\\n  kasan_save_free_info+0x3b/0x60\\n  __kasan_slab_free+0x43/0x70\\n  kfree+0x135/0x410\\n  fst_remove_one+0x2ca/0x540\\n  pci_device_remove+0xa6/0x1d0\\n  device_release_driver_internal+0x364/0x530\\n  pci_stop_bus_device+0x105/0x150\\n  pci_stop_and_remove_bus_device+0xd/0x20\\n  disable_slot+0x116/0x260\\n  acpiphp_disable_and_eject_slot+0x4b/0x190\\n  acpiphp_hotplug_notify+0x230/0x3c0\\n  acpi_device_hotplug+0x203/0xb10\\n  acpi_hotplug_work_fn+0x59/0x80\\n ...\\n\\n The buggy address belongs to the object at ffff88800aad1000\\n  which belongs to the cache kmalloc-1k of size 1024\\n The buggy address is located 28 bytes inside of\\n  freed 1024-byte region\\n The buggy address belongs to the physical page:\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\n flags: 0x100000000000040(head|node=0|zone=1)\\n page_type: f5(slab)\\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n \u003effff88800aad1000: fa fb\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wan/farsync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"51e2d1b84acac39f79cacb60e6e154ce00a9d308\",\"lessThan\":\"cac048ebfbb92d91d719f74b59177cb70a7633b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"998b4e54f517961d3d75144c088a24423e003005\",\"lessThan\":\"086131807d119238cd464e5b0845e48d938dfd79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bb1715a6bfb0c57a68524732a376498a2569f016\",\"lessThan\":\"ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f623aaf9f31de968dea6169849706a2f9be444c\",\"lessThan\":\"337d7b4112a47984ee319171b75b73bab47e7924\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f623aaf9f31de968dea6169849706a2f9be444c\",\"lessThan\":\"200bdb8d367ca9b478f9c56ebe56411604d55c81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f623aaf9f31de968dea6169849706a2f9be444c\",\"lessThan\":\"21d341fe514fd07e345ed264c9eee21cb2061ca2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f623aaf9f31de968dea6169849706a2f9be444c\",\"lessThan\":\"04edfdfdfcdefc02408ab670607261b0a0a9a02e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f623aaf9f31de968dea6169849706a2f9be444c\",\"lessThan\":\"bae8a5d2e759da2e0cba33ab2080deee96a09373\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41798a063fd4721b609e11ad839b6820f5070ca7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b1fe377b43c405b169cffd1b3aa39c1dde16f3ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ce9dc768767bbe73d2dd330a9075e849cb8a84d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0c5f2c7700cb18aeab1574588d3bb9c0454bf228\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.163\",\"lessThan\":\"5.10.252\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.86\",\"lessThan\":\"5.15.202\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.2\",\"lessThan\":\"6.1.165\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.337\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.303\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.270\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.229\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.0.16\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wan/farsync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.252\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.202\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.165\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.337\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"0C8C5100-ECF6-4F64-9489-EFC7923A7591\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.303\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"68B456F6-323E-4372-A707-523AAA068DF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.270\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"C08F8902-A527-4C5E-A1BC-1DA79FBF4CB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.229\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"591759E0-9179-476B-B922-DD6AA7773219\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.163\",\"versionEndExcluding\":\"5.10.252\",\"matchCriteriaId\":\"1D2D6DEE-F438-44A6-8330-B2B230EF7798\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.86\",\"versionEndExcluding\":\"5.15.202\",\"matchCriteriaId\":\"944E0E69-FFE6-4BC9-B05F-AA316D9370A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.16\",\"versionEndExcluding\":\"6.1\",\"matchCriteriaId\":\"6C7522E3-150F-436D-BBD7-96C7B4B795ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.2\",\"versionEndExcluding\":\"6.1.165\",\"matchCriteriaId\":\"ED6D1FF0-31EB-453B-8BF3-1CDCB55AC3EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:30:23+00:00",
      "cve": "CVE-2026-43232",
      "id": "CVE-2026-43232",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43232.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T17:07:33Z",
      "cve": "CVE-2026-43232",
      "id": "CVE-2026-43232",
      "initial_release_date": "2026-05-09T02:40:28Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "424",
      "product_status:known_not_affected": "294",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43232",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43232.json",
      "version": "8"
    }
  }
}

FKIE_CVE-2026-43232

Vulnerability from fkie_nvd - Published: 2026-05-06 12:16 - Updated: 2026-06-17 10:49

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	7.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wan/farsync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cac048ebfbb92d91d719f74b59177cb70a7633b8",
              "status": "affected",
              "version": "51e2d1b84acac39f79cacb60e6e154ce00a9d308",
              "versionType": "git"
            },
            {
              "lessThan": "086131807d119238cd464e5b0845e48d938dfd79",
              "status": "affected",
              "version": "998b4e54f517961d3d75144c088a24423e003005",
              "versionType": "git"
            },
            {
              "lessThan": "ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc",
              "status": "affected",
              "version": "bb1715a6bfb0c57a68524732a376498a2569f016",
              "versionType": "git"
            },
            {
              "lessThan": "337d7b4112a47984ee319171b75b73bab47e7924",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "200bdb8d367ca9b478f9c56ebe56411604d55c81",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "21d341fe514fd07e345ed264c9eee21cb2061ca2",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "04edfdfdfcdefc02408ab670607261b0a0a9a02e",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "bae8a5d2e759da2e0cba33ab2080deee96a09373",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "41798a063fd4721b609e11ad839b6820f5070ca7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1fe377b43c405b169cffd1b3aa39c1dde16f3ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce9dc768767bbe73d2dd330a9075e849cb8a84d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c5f2c7700cb18aeab1574588d3bb9c0454bf228",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.252",
              "status": "affected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.202",
              "status": "affected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.165",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wan/farsync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8C5100-ECF6-4F64-9489-EFC7923A7591",
              "versionEndExcluding": "4.10",
              "versionStartIncluding": "4.9.337",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "68B456F6-323E-4372-A707-523AAA068DF8",
              "versionEndExcluding": "4.15",
              "versionStartIncluding": "4.14.303",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C08F8902-A527-4C5E-A1BC-1DA79FBF4CB1",
              "versionEndExcluding": "4.20",
              "versionStartIncluding": "4.19.270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "591759E0-9179-476B-B922-DD6AA7773219",
              "versionEndExcluding": "5.5",
              "versionStartIncluding": "5.4.229",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D2D6DEE-F438-44A6-8330-B2B230EF7798",
              "versionEndExcluding": "5.10.252",
              "versionStartIncluding": "5.10.163",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "944E0E69-FFE6-4BC9-B05F-AA316D9370A4",
              "versionEndExcluding": "5.15.202",
              "versionStartIncluding": "5.15.86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C7522E3-150F-436D-BBD7-96C7B4B795ED",
              "versionEndExcluding": "6.1",
              "versionStartIncluding": "6.0.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED6D1FF0-31EB-453B-8BF3-1CDCB55AC3EF",
              "versionEndExcluding": "6.1.165",
              "versionStartIncluding": "6.1.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2",
              "versionEndExcluding": "6.6.128",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2",
              "versionEndExcluding": "6.12.75",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B",
              "versionEndExcluding": "6.18.16",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
              "versionEndExcluding": "6.19.6",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-\u003e //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  \u003cIRQ\u003e\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff88800aad1000: fa fb\n---truncated---"
    }
  ],
  "id": "CVE-2026-43232",
  "lastModified": "2026-06-17T10:49:12.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-06T12:16:43.223",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-84HG-9FJM-PCR7

Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-08 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets

When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs when the already freed fst_card_info is accessed in fst_process_tx_work_q() or fst_process_int_work_q().

A typical race condition is depicted below:

The following KASAN trace was captured:

================================================================== BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 ? do_bottom_half_tx+0xb88/0xd00 kasan_report+0xb8/0xf0 ? do_bottom_half_tx+0xb88/0xd00 do_bottom_half_tx+0xb88/0xd00 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfxhrtimerrun_queues+0x10/0x10 fst_process_tx_work_q+0x67/0x90 tasklet_action_common+0x1fa/0x720 ? hrtimer_interrupt+0x31f/0x780 handle_softirqs+0x176/0x530 irq_exit_rcu+0xab/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ...

Allocated by task 41 on cpu 3 at 72.330843s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 fst_add_one+0x1a5/0x1cd0 local_pci_probe+0xdd/0x190 pci_device_probe+0x341/0x480 really_probe+0x1c6/0x6a0 __driver_probe_device+0x248/0x310 driver_probe_device+0x48/0x210 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x101/0x190 __device_attach+0x198/0x3a0 device_initial_probe+0x78/0xa0 pci_bus_add_device+0x81/0xc0 pci_bus_add_devices+0x7e/0x190 enable_slot+0x9b9/0x1130 acpiphp_check_bridge.part.0+0x2e1/0x460 acpiphp_hotplug_notify+0x36c/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ...

Freed by task 41 on cpu 1 at 75.138639s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x135/0x410 fst_remove_one+0x2ca/0x540 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0x364/0x530 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device+0xd/0x20 disable_slot+0x116/0x260 acpiphp_disable_and_eject_slot+0x4b/0x190 acpiphp_hotplug_notify+0x230/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ...

The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

ffff88800aad1000: fa fb ---truncated---

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-43232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T12:16:43Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-\u003e //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  \u003cIRQ\u003e\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff88800aad1000: fa fb\n---truncated---",
  "id": "GHSA-84hg-9fjm-pcr7",
  "modified": "2026-05-08T15:31:18Z",
  "published": "2026-05-06T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43232"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2026:21555-1

Vulnerability from csaf_opensuse - Published: 2026-08-12 01:09 - Updated: 2026-09-16 09:07

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 136 products

Open the full advisory

SUSE-SU-2026:23066-1

Vulnerability from csaf_suse - Published: 2026-08-11 20:56 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:23068-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:26 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 28 products

Open the full advisory

SUSE-SU-2026:23193-1

Vulnerability from csaf_suse - Published: 2026-08-18 18:56 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

648 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:23194-1

Vulnerability from csaf_suse - Published: 2026-08-18 19:48 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

647 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 14 products

Open the full advisory

SUSE-SU-2026:23221-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:26 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 114 products

Open the full advisory

SUSE-SU-2026:23231-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:26 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 114 products

Open the full advisory

SUSE-SU-2026:23237-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:34 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43232.

CVE-2026-43232

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 9 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-43232 (GCVE-0-2026-43232)

Tags

Sightings

Nomenclature

Related by attack behaviour