Use-after-free in Linux kernel - CVE-2026-43203
Published: May 7, 2026
Vulnerability identifier: #VU130532
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-43203
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in fore200e tx_tasklet and rx_tasklet handlers when handling tasklets during device removal. A local attacker can trigger a race condition involving device detachment and pending or running tasklets to cause a denial of service.
The issue occurs when a PCA-200E or SBA-200E adapter is being detached.
Remediation
Install security update from vendor's repository.
External links
- https://git.kernel.org/stable/c/5189368f10903956be05062d160b2804bf5e5016
- https://git.kernel.org/stable/c/73fbc5d1a9ccb626937500bbd67136f077d8237b
- https://git.kernel.org/stable/c/8930878101cd40063888a68af73b1b0f8b6c79bc
- https://git.kernel.org/stable/c/91f25749aaf57c47ae1e12478144e6ea8c8562f2
- https://git.kernel.org/stable/c/97900f512252a59f23d6ce4ab215cc88fed66e68
- https://git.kernel.org/stable/c/aba0b4bc09376dfc3d53c826514fe38fc8337f52
- https://git.kernel.org/stable/c/e075ec9b08f862dade8011481058f7eb5f716c57
- https://git.kernel.org/stable/c/e4ff4e3ffcf9d5aad380cdd1d8cdc008bb34f97d