Linux: Use After Free
CVE-2026-43232 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists versions cac048ebfbb92d91d719f74b59177cb70a7633b8, 086131807d119238cd464e5b0845e48d938dfd79, ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.39% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to cac048ebfbb92d91d719f74b59177cb70a7633b8 or 086131807d119238cd464e5b0845e48d938dfd79 or ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc or 337d7b4112a47984ee319171b75b73bab47e7924, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.10 or 4.15 or 4.20 or 5.5, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 51e2d1b84acac39f79cacb60e6e154ce00a9d308 up to, but not including, cac048ebfbb92d91d719f74b59177cb70a7633b8; 998b4e54f517961d3d75144c088a24423e003005 up to, but not including, 086131807d119238cd464e5b0845e48d938dfd79; bb1715a6bfb0c57a68524732a376498a2569f016 up to, but not including, ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc; 2f623aaf9f31de968dea6169849706a2f9be444c up to, but not including, 337d7b4112a47984ee319171b75b73bab47e7924; 2f623aaf9f31de968dea6169849706a2f9be444c up to, but not including, 200bdb8d367ca9b478f9c56ebe56411604d55c81; 2f623aaf9f31de968dea6169849706a2f9be444c up to, but not including, 21d341fe514fd07e345ed264c9eee21cb2061ca2; 2f623aaf9f31de968dea6169849706a2f9be444c up to, but not including, 04edfdfdfcdefc02408ab670607261b0a0a9a02e; 2f623aaf9f31de968dea6169849706a2f9be444c up to, but not including, bae8a5d2e759da2e0cba33ab2080deee96a09373; and 14 more ranges | cac048ebfbb92d91d719f74b59177cb70a7633b8, 086131807d119238cd464e5b0845e48d938dfd79, ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc, 337d7b4112a47984ee319171b75b73bab47e7924, 200bdb8d367ca9b478f9c56ebe56411604d55c81, 21d341fe514fd07e345ed264c9eee21cb2061ca2 |
| Linux | Linux Kernel | 4.9.337 up to, but not including, 4.10; 4.14.303 up to, but not including, 4.15; 4.19.270 up to, but not including, 4.20; 5.4.229 up to, but not including, 5.5; 5.10.163 up to, but not including, 5.10.252; 5.15.86 up to, but not including, 5.15.202; 6.0.16 up to, but not including, 6.1; 6.1.2 up to, but not including, 6.1.165; and 5 more ranges | 4.10, 4.15, 4.20, 5.5, 5.10.252, 5.15.202 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs when the already freed fst_card_info is accessed in fst_process_tx_work_q() or fst_process_int_work_q(). A typical race condition is depicted below: CPU 0 (cleanup) | CPU 1 (tasklet) | fst_start_xmit() fst_remove_one() | tasklet_schedule() unregister_hdlc_device()| | fst_process_tx_work_q() //handler kfree(card) //free | do_bottom_half_tx() | card-> //use The following KASAN trace was captured: ================================================================== BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 ? do_bottom_half_tx+0xb88/0xd00 kasan_report+0xb8/0xf0 ? do_bottom_half_tx+0xb88/0xd00 do_bottom_half_tx+0xb88/0xd00 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx___hrtimer_run_queues+0x10/0x10 fst_process_tx_work_q+0x67/0x90 tasklet_action_common+0x1fa/0x720 ? hrtimer_interrupt+0x31f/0x780 handle_softirqs+0x176/0x530 __irq_exit_rcu+0xab/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 41 on cpu 3 at 72.330843s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 fst_add_one+0x1a5/0x1cd0 local_pci_probe+0xdd/0x190 pci_device_probe+0x341/0x480 really_probe+0x1c6/0x6a0 __driver_probe_device+0x248/0x310 driver_probe_device+0x48/0x210 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x101/0x190 __device_attach+0x198/0x3a0 device_initial_probe+0x78/0xa0 pci_bus_add_device+0x81/0xc0 pci_bus_add_devices+0x7e/0x190 enable_slot+0x9b9/0x1130 acpiphp_check_bridge.part.0+0x2e1/0x460 acpiphp_hotplug_notify+0x36c/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... Freed by task 41 on cpu 1 at 75.138639s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x135/0x410 fst_remove_one+0x2ca/0x540 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0x364/0x530 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device+0xd/0x20 disable_slot+0x116/0x260 acpiphp_disable_and_eject_slot+0x4b/0x190 acpiphp_hotplug_notify+0x230/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800aad1000: fa fb ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e
- git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79
- git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81
- git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2
- git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924
- git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc
- git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373
- git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8
Recent Use After Free vulnerabilities
- 8.8 High severity
- 8.8 High severity
- 8.3 High severity
- 8.8 High severity
- 8.8 High severity
- 8.3 High severity
Spotted an error? Tell us.