Linux: Improper Locking
CVE-2026-43211 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ebb27b7399ab8b9eb1f792b329aa5f6250c590d4, fbe06a3058114bf95a17a4941b205f4b321c6f0a, 943ed56606a7ab2fe5a99cad572dd17d484310c7 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.11% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to ebb27b7399ab8b9eb1f792b329aa5f6250c590d4 or fbe06a3058114bf95a17a4941b205f4b321c6f0a or 943ed56606a7ab2fe5a99cad572dd17d484310c7 or a19b61fdb958ffadbba85b43c991eb9fc70c1c1c, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.20 or 5.5 or 5.10.252 or 5.15.202, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | e2355d513b89a2cb511b4ded0deb426cdb01acd0 up to, but not including, ebb27b7399ab8b9eb1f792b329aa5f6250c590d4; 04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945 up to, but not including, fbe06a3058114bf95a17a4941b205f4b321c6f0a; 7253b4fed46471cc247c6cacefac890a8472c083 up to, but not including, 943ed56606a7ab2fe5a99cad572dd17d484310c7; 78c6e39fef5c428960aff742149bba302dd46f5a up to, but not including, a19b61fdb958ffadbba85b43c991eb9fc70c1c1c; a4e772898f8bf2e7e1cf661a12c60a5612c4afab up to, but not including, 0425aaf20b407d2f2cf3bf469808e4a35f9abb8b; a4e772898f8bf2e7e1cf661a12c60a5612c4afab up to, but not including, bd435f4b738130d732ef64e0e57e45185f77165d; a4e772898f8bf2e7e1cf661a12c60a5612c4afab up to, but not including, 8b08ea9690b212b7bf7f12414039259cf34b1aa0; a4e772898f8bf2e7e1cf661a12c60a5612c4afab up to, but not including, 9368d1ee62829b08aa31836b3ca003803caf0b72; and 11 more ranges | ebb27b7399ab8b9eb1f792b329aa5f6250c590d4, fbe06a3058114bf95a17a4941b205f4b321c6f0a, 943ed56606a7ab2fe5a99cad572dd17d484310c7, a19b61fdb958ffadbba85b43c991eb9fc70c1c1c, 0425aaf20b407d2f2cf3bf469808e4a35f9abb8b, bd435f4b738130d732ef64e0e57e45185f77165d |
| Linux | Linux Kernel | 4.19.322 up to, but not including, 4.20; 5.4.284 up to, but not including, 5.5; 5.10.226 up to, but not including, 5.10.252; 5.15.167 up to, but not including, 5.15.202; 6.1.110 up to, but not including, 6.1.165; 6.6.51 up to, but not including, 6.6.128; 6.10.10 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; and 1 more ranges | 4.20, 5.5, 5.10.252, 5.15.202, 6.1.165, 6.6.128 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/[email protected]]
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/0425aaf20b407d2f2cf3bf469808e4a35f9abb8b
- git.kernel.org/stable/c/8b08ea9690b212b7bf7f12414039259cf34b1aa0
- git.kernel.org/stable/c/9368d1ee62829b08aa31836b3ca003803caf0b72
- git.kernel.org/stable/c/943ed56606a7ab2fe5a99cad572dd17d484310c7
- git.kernel.org/stable/c/a19b61fdb958ffadbba85b43c991eb9fc70c1c1c
- git.kernel.org/stable/c/bd435f4b738130d732ef64e0e57e45185f77165d
- git.kernel.org/stable/c/ebb27b7399ab8b9eb1f792b329aa5f6250c590d4
- git.kernel.org/stable/c/fbe06a3058114bf95a17a4941b205f4b321c6f0a
Recent Improper Locking vulnerabilities
- 7.5 High severity
- 8.8 High severity
- 7.5 High severity
- 7.8 High severity
- 8.8 High severity
- 7.5 High severity
Spotted an error? Tell us.