CVE-2026-43232 [High] | Use-After-Free in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs when the already freed fst_card_info is accessed in fst_process_tx_work_q() or fst_process_int_work_q(). A typical race condition is depicted below: CPU 0 (cleanup) | CPU 1 (tasklet) | fst_start_xmit() fst_remove_one() | tasklet_schedule() unregister_hdlc_device()| | fst_process_tx_work_q() //handler kfree(card) //free | do_bottom_half_tx() | card-> //use The following KASAN trace was captured: ================================================================== BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 ? do_bottom_half_tx+0xb88/0xd00 kasan_report+0xb8/0xf0 ? do_bottom_half_tx+0xb88/0xd00 do_bottom_half_tx+0xb88/0xd00 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx___hrtimer_run_queues+0x10/0x10 fst_process_tx_work_q+0x67/0x90 tasklet_action_common+0x1fa/0x720 ? hrtimer_interrupt+0x31f/0x780 handle_softirqs+0x176/0x530 __irq_exit_rcu+0xab/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 41 on cpu 3 at 72.330843s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 fst_add_one+0x1a5/0x1cd0 local_pci_probe+0xdd/0x190 pci_device_probe+0x341/0x480 really_probe+0x1c6/0x6a0 __driver_probe_device+0x248/0x310 driver_probe_device+0x48/0x210 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x101/0x190 __device_attach+0x198/0x3a0 device_initial_probe+0x78/0xa0 pci_bus_add_device+0x81/0xc0 pci_bus_add_devices+0x7e/0x190 enable_slot+0x9b9/0x1130 acpiphp_check_bridge.part.0+0x2e1/0x460 acpiphp_hotplug_notify+0x36c/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... Freed by task 41 on cpu 1 at 75.138639s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x135/0x410 fst_remove_one+0x2ca/0x540 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0x364/0x530 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device+0xd/0x20 disable_slot+0x116/0x260 acpiphp_disable_and_eject_slot+0x4b/0x190 acpiphp_hotplug_notify+0x230/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800aad1000: fa fb ---truncated---

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-07	0.02%	0.05%	+0.03%
2	2026-05-07	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-07

0.02%

0.05%

+0.03%

2026-05-07

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
8.8	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	2.8	5.9	416baaa9-dc9f-4396-8d5f-8c081fb06d67

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

8.8

3.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

2.8

5.9

416baaa9-dc9f-4396-8d5f-8c081fb06d67

OS Trackers for CVE-2026-43232

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2026-43232 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2026-43232
`redhat`	—	—	https://access.redhat.com/security/cve/CVE-2026-43232
`suse`	medium	CVE-2026-43232 severity moderate: SUSE including 21 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 178 product×package rows across 37 product lines (SUSE Linux Enterprise High Availability Extension 15 SP7, SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, … (37 product lines)): Known Not Affected 178.	https://www.suse.com/security/cve/CVE-2026-43232/
`ubuntu`	medium	CVE-2026-43232 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 170, needed 125, released 83, not-affected 17, needs-triage 5, pending 1.	https://ubuntu.com/security/CVE-2026-43232

Affected software / configurations for CVE-2026-43232

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 4.9.337, < 4.10	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 4.14.303, < 4.15	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 4.19.270, < 4.20	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.4.229, < 5.5	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.10.163, < 5.10.252	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.15.86, < 5.15.202	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.0.16, < 6.1	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.1.2, < 6.1.165	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.2, < 6.6.128	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.7, < 6.12.75	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.18.16	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.19, < 6.19.6	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	7.0	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

References for CVE-2026-43232

URL	Tags
https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e	Patch
https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79	Patch
https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81	Patch
https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2	Patch
https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924	Patch
https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc	Patch
https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373	Patch
https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8	Patch

URL

CVE-2026-43232 | net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets

Exploit prediction scoring system (EPSS) score for CVE-2026-43232

Common vulnerability scoring system (CVSS) metrics for CVE-2026-43232

Weakness enumeration for CVE-2026-43232

GitHub Security Advisory for CVE-2026-43232

OS Trackers for CVE-2026-43232

Affected software / configurations for CVE-2026-43232

References for CVE-2026-43232