Use-after-free in Linux kernel - CVE-2026-43056

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128856

Use-after-free in Linux kernel - CVE-2026-43056

Published: May 2, 2026


Vulnerability identifier: #VU128856
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-43056
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in add_adev() when handling an error path after auxiliary_device_add() fails. A local user can trigger the failure condition to cause a denial of service.


Affected software

Linux kernel
Anolis OS
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-debug-modules
kernel-abi-stablelists
python3-perf
perf
kernel-tools-libs-devel
kernel-tools-libs
kernel-tools
kernel-modules-extra
kernel-modules
kernel-headers
kernel-devel
kernel-debug-modules-extra
kernel-debug-devel
kernel-debug-core
kernel-debug
kernel-cross-headers
kernel-core
kernel
bpftool
kernel-doc
linux (Ubuntu package)
linux-fips (Ubuntu package)
linux-hwe-6.8 (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle-6.8 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-aws (Ubuntu package)
linux-raspi (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-azure (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-gcp-fips (Ubuntu package)

How to mitigate CVE-2026-43056

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel (Red Hat package) - addressed in versions 4.18.0-553.136.1.el8_10, 5.14.0-687.15.1.el9_8, 6.12.0-211.26.1.el10_2
kernel-rt (Red Hat package) - update to 4.18.0-553.136.1.rt7.477.el8_10
kernel-debug-modules - update to 4.18.0-553.137.1.0.1
kernel-abi-stablelists - update to 4.18.0-553.137.1.0.1
python3-perf - update to 4.18.0-553.137.1.0.1
perf - update to 4.18.0-553.137.1.0.1
kernel-tools-libs-devel - update to 4.18.0-553.137.1.0.1
kernel-tools-libs - update to 4.18.0-553.137.1.0.1
kernel-tools - update to 4.18.0-553.137.1.0.1
kernel-modules-extra - update to 4.18.0-553.137.1.0.1
kernel-modules - update to 4.18.0-553.137.1.0.1
kernel-headers - update to 4.18.0-553.137.1.0.1
kernel-devel - update to 4.18.0-553.137.1.0.1
kernel-debug-modules-extra - update to 4.18.0-553.137.1.0.1
kernel-debug-devel - update to 4.18.0-553.137.1.0.1
kernel-debug-core - update to 4.18.0-553.137.1.0.1
kernel-debug - update to 4.18.0-553.137.1.0.1
kernel-cross-headers - update to 4.18.0-553.137.1.0.1
kernel-core - update to 4.18.0-553.137.1.0.1
kernel - update to 4.18.0-553.137.1.0.1
bpftool - update to 4.18.0-553.137.1.0.1
kernel-doc - update to 4.18.0-553.137.1.0.1
linux (Ubuntu package) - addressed in versions 6.8.0-136.136, 6.8.0-1046.50, 6.8.0-1059.67, 6.8.0-1064.72, 6.8.0-1064.72~22.04.1, 6.8.1-1056.57, 6.8.1-1056.57~22.04.2
linux-fips (Ubuntu package) - addressed in versions 6.8.0-136.136+fips2, 6.8.0-136.136.2, 6.8.0-136.136.2~22.04.1, 6.8.0-1058.61
linux-hwe-6.8 (Ubuntu package) - update to 6.8.0-136.136~22.04.1
linux-ibm (Ubuntu package) - addressed in versions 6.8.0-1030.31, 6.8.0-1033.34, 6.8.0-1061.62, 6.8.0-1061.62~22.04.1
linux-oracle-6.8 (Ubuntu package) - update to 6.8.0-1058.61~22.04.1
linux-nvidia (Ubuntu package) - addressed in versions 6.8.0-1059.62, 6.8.0-1059.62.1, 6.8.0-1059.62~22.04.1
linux-aws-6.8 (Ubuntu package) - addressed in versions 6.8.0-1061.64+fips1, 6.8.0-1061.64~22.04.1
linux-aws (Ubuntu package) - update to 6.8.0-1061.64+1
linux-raspi (Ubuntu package) - addressed in versions 6.8.0-1061.65, 6.8.0-2050.52
linux-azure-fde (Ubuntu package) - update to 6.8.0-1062.69
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1062.69~22.04.1
linux-azure (Ubuntu package) - addressed in versions 6.8.0-1063.71, 6.8.0-1063.71~22.04.1
linux-azure-fips (Ubuntu package) - update to 6.8.0-1063.71+fips2
linux-gcp-fips (Ubuntu package) - update to 6.8.0-1064.72+fips1

External References

Related Security Bulletins