CVE-2026-43200: PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions

Q: Who is realistically exposed to this issue?

Systems using the Linux kernel PCI endpoint subsystem and performing configfs unlink operations involving primary or secondary EPC/EPF links are exposed. The reported failure occurs when the unlink command is used in configfs.

Q: What access does an attacker need to trigger the crash?

The CVSS vector indicates local access with low privileges and no user interaction is required. Triggering the issue requires reaching the affected configfs unlink path.

Q: What is the impact of successful exploitation?

The incorrect callback parameter ordering can cause a kernel paging-request crash during unlink processing. The CVSS assessment identifies the impact as high availability impact, with no confidentiality or integrity impact.

Q: What should administrators do if their systems use this functionality?

Apply an available Linux kernel patch containing the fix. If patching cannot be performed immediately, avoid configfs unlink operations for the affected PCI endpoint primary or secondary EPC/EPF links.

Published May 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: Fix swapped parameters in pci{primary/secondary}epcepfunlink() functions

struct configfsitemoperations callbacks are defined like the following:

int (allowlink)(struct configitem src, struct configitem target); void (droplink)(struct configitem src, struct configitem target);

While pciprimaryepcepflink() and pcisecondaryepcepflink() specify the parameters in the correct order, pciprimaryepcepfunlink() and pcisecondaryepcepfunlink() specify the parameters in the wrong order, leading to the below kernel crash when using the unlink command in configfs:

Unable to handle kernel paging request at virtual address 0000000300000857 Mem abort info: ... pc : string+0x54/0x14c lr : vsnprintf+0x280/0x6e8 ... string+0x54/0x14c vsnprintf+0x280/0x6e8 vprintkdefault+0x38/0x4c vprintk+0xc4/0xe0 pciepfunbind+0xdc/0x108 configfsunlink+0xe0/0x208+0x44/0x74 vfsunlink+0x120/0x29c arm64sysunlinkat+0x3c/0x90 invokesyscall+0x48/0x134 doel0svc+0x1c/0x30prop.0+0xd0/0xf0

[mani: cced stable, changed commit message as per https://lore.kernel.org/linux-pci/aV9joi3jF1R6ca02@ryzen]

Affected Software

7 affected components

Linux Linux kernel

Linux Linux kernel>=5.12<5.15.202

Linux Linux kernel>=5.16<6.1.165

Linux Linux kernel>=6.2<6.6.128

Linux Linux kernel>=6.7<6.12.75

Linux Linux kernel>=6.13<6.18.16

Linux Linux kernel>=6.19<6.19.6

Remediation

Event History

May 6, 2026

CVE Published

via MITRE·11:28 AM

Data Sourced

via MITRE·11:28 AM

Description

Data Sourced

via NVD·12:16 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using the Linux kernel PCI endpoint subsystem and performing configfs unlink operations involving primary or secondary EPC/EPF links are exposed. The reported failure occurs when the unlink command is used in configfs.

What access does an attacker need to trigger the crash?

The CVSS vector indicates local access with low privileges and no user interaction is required. Triggering the issue requires reaching the affected configfs unlink path.

What is the impact of successful exploitation?

The incorrect callback parameter ordering can cause a kernel paging-request crash during unlink processing. The CVSS assessment identifies the impact as high availability impact, with no confidentiality or integrity impact.

What should administrators do if their systems use this functionality?

Apply an available Linux kernel patch containing the fix. If patching cannot be performed immediately, avoid configfs unlink operations for the affected PCI endpoint primary or secondary EPC/EPF links.

CVE-2026-43200: PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to trigger the crash?

What is the impact of successful exploitation?

What should administrators do if their systems use this functionality?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to trigger the crash?

What is the impact of successful exploitation?

What should administrators do if their systems use this functionality?