{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-43232", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-43232" ], "published": "2026-05-06T11:29:17Z", "summary": "net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup) | CPU 1 (tasklet)\n | fst_start_xmit()\nfst_remove_one() | tasklet_schedule()\n unregister_hdlc_device()|\n | fst_process_tx_work_q() //handler\n kfree(card) //free | do_bottom_half_tx()\n | card-> //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n \n dump_stack_lvl+0x55/0x70\n print_report+0xcb/0x5d0\n ? do_bottom_half_tx+0xb88/0xd00\n kasan_report+0xb8/0xf0\n ? do_bottom_half_tx+0xb88/0xd00\n do_bottom_half_tx+0xb88/0xd00\n ? _raw_spin_lock_irqsave+0x85/0xe0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx___hrtimer_run_queues+0x10/0x10\n fst_process_tx_work_q+0x67/0x90\n tasklet_action_common+0x1fa/0x720\n ? hrtimer_interrupt+0x31f/0x780\n handle_softirqs+0x176/0x530\n __irq_exit_rcu+0xab/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0x7f/0x90\n fst_add_one+0x1a5/0x1cd0\n local_pci_probe+0xdd/0x190\n pci_device_probe+0x341/0x480\n really_probe+0x1c6/0x6a0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x48/0x210\n __device_attach_driver+0x160/0x320\n bus_for_each_drv+0x101/0x190\n __device_attach+0x198/0x3a0\n device_initial_probe+0x78/0xa0\n pci_bus_add_device+0x81/0xc0\n pci_bus_add_devices+0x7e/0x190\n enable_slot+0x9b9/0x1130\n acpiphp_check_bridge.part.0+0x2e1/0x460\n acpiphp_hotplug_notify+0x36c/0x3c0\n acpi_device_hotplug+0x203/0xb10\n acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x135/0x410\n fst_remove_one+0x2ca/0x540\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0x364/0x530\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device+0xd/0x20\n disable_slot+0x116/0x260\n acpiphp_disable_and_eject_slot+0x4b/0x190\n acpiphp_hotplug_notify+0x230/0x3c0\n acpi_device_hotplug+0x203/0xb10\n acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n >ffff88800aad1000: fa fb\n---truncated---", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.165", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43232" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T13:16:28Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.8, "cvss_v3_severity": "High", "scenario": "AV:N - The vulnerable tasklets can be queued by received frames/interrupts from a remote peer on the FarSync HDLC/WAN network link. The required device detach is accounted for under UI.\nAC:L - An attacker can keep RX/interrupt work pending by continuously sending traffic, and the bug is an unsynchronized tasklet teardown rather than a condition requiring special memory layout. The race is therefore reasonably triggerable during detach.\nPR:N - The remote peer does not need local privileges or authentication to generate receive interrupts that queue the vulnerable work. Administrative privilege is only needed for the victim-side detach action, not for the attacker\u2019s network input.\nUI:R - The remote attack scenario requires another user or administrator to detach, unbind, hot-unplug, or unload the FarSync device while tasklet work is pending. Without that detach path, the freed-card use-after-free is not reached.\nS:U - The bug is within a kernel device driver and impacts kernel memory in the same security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - This is a slab use-after-free of the kmalloc-1k fst_card_info object, whose stale pointers and state are dereferenced by tasklet handlers. Kernel UAFs can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The freed card object controls subsequent I/O, DMA/status updates, queue handling, and netdev/port state accesses. As kernel UAF memory corruption, it can plausibly be shaped into write/control-flow corruption, so integrity impact is High.\nA:H - The reported KASAN trace shows a slab-use-after-free in softirq/tasklet context, which can crash or panic the kernel. Repeated triggering during detach can therefore cause high availability impact." } } }