Linux: Improper Locking
CVE-2026-43296 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 9a3fd301329474f449e75f86d8a4f6b9c603fd6c, d0b3c8a80336029d9356f429151eb27922d80a3c, 36cc5a5e0178d5fb79e04173b8aa623b0108819a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.39% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 9a3fd301329474f449e75f86d8a4f6b9c603fd6c or d0b3c8a80336029d9356f429151eb27922d80a3c or 36cc5a5e0178d5fb79e04173b8aa623b0108819a or d9b549b6951ba178ec14339a031cae65f4e43fe1, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.252 or 5.15.202 or 6.1.165 or 6.6.128, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, 9a3fd301329474f449e75f86d8a4f6b9c603fd6c; 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, d0b3c8a80336029d9356f429151eb27922d80a3c; 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, 36cc5a5e0178d5fb79e04173b8aa623b0108819a; 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, d9b549b6951ba178ec14339a031cae65f4e43fe1; 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, cec2ceb35ce7bc874c43812bb39200d6cf691b87; 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, 8052d0587fb14b85539c3a14a226586c0c3d6b4c; 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, b7eba260a34e854e2487b8363c11976f082df00d; 5d9b976d4480dc0dcfa3719b645636d2f0f9f156 up to, but not including, 70e9a5760abfb6338d63994d4de6b0778ec795d6; and 1 more ranges | 9a3fd301329474f449e75f86d8a4f6b9c603fd6c, d0b3c8a80336029d9356f429151eb27922d80a3c, 36cc5a5e0178d5fb79e04173b8aa623b0108819a, d9b549b6951ba178ec14339a031cae65f4e43fe1, cec2ceb35ce7bc874c43812bb39200d6cf691b87, 8052d0587fb14b85539c3a14a226586c0c3d6b4c |
| Linux | Linux Kernel | 5.5 up to, but not including, 5.10.252; 5.11 up to, but not including, 5.15.202; 5.16 up to, but not including, 6.1.165; 6.2 up to, but not including, 6.6.128; 6.7 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; 6.19 up to, but not including, 6.19.6 | 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky NIX SQ manager sticky mode is known to cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE may deadlock on transitions between sticky and non-sticky transmissions. There is also a credit drop issue observed when certain condition clocks are gated. work around these hardware errata by: - Disabling SQM sticky operation: - Clear TM6 (bit 15) - Clear TM11 (bit 14) - Disabling sticky → non-sticky transition path that can deadlock PSE: - Clear TM5 (bit 23) - Preventing credit drops by keeping the control-flow clock enabled: - Set TM9 (bit 21) These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this configuration the SQM/PSE maintain forward progress under load without credit loss, at the cost of disabling sticky optimizations.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/36cc5a5e0178d5fb79e04173b8aa623b0108819a
- git.kernel.org/stable/c/70e9a5760abfb6338d63994d4de6b0778ec795d6
- git.kernel.org/stable/c/8052d0587fb14b85539c3a14a226586c0c3d6b4c
- git.kernel.org/stable/c/9a3fd301329474f449e75f86d8a4f6b9c603fd6c
- git.kernel.org/stable/c/b7eba260a34e854e2487b8363c11976f082df00d
- git.kernel.org/stable/c/cec2ceb35ce7bc874c43812bb39200d6cf691b87
- git.kernel.org/stable/c/d0b3c8a80336029d9356f429151eb27922d80a3c
- git.kernel.org/stable/c/d9b549b6951ba178ec14339a031cae65f4e43fe1
Recent Improper Locking vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 8.8 High severity
- 7.8 High severity
- 7.5 High severity
- 7.8 High severity
Spotted an error? Tell us.