CVE-2026-43200: PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Fix swapped parameters in pci{primary/secondary}epcepfunlink() functions
struct configfsitemoperations callbacks are defined like the following:
int (allowlink)(struct configitem src, struct configitem target); void (droplink)(struct configitem src, struct configitem target);
While pciprimaryepcepflink() and pcisecondaryepcepflink() specify the parameters in the correct order, pciprimaryepcepfunlink() and pcisecondaryepcepfunlink() specify the parameters in the wrong order, leading to the below kernel crash when using the unlink command in configfs:
Unable to handle kernel paging request at virtual address 0000000300000857 Mem abort info: ... pc : string+0x54/0x14c lr : vsnprintf+0x280/0x6e8 ... string+0x54/0x14c vsnprintf+0x280/0x6e8 vprintkdefault+0x38/0x4c vprintk+0xc4/0xe0 pciepfunbind+0xdc/0x108 configfsunlink+0xe0/0x208+0x44/0x74 vfsunlink+0x120/0x29c arm64sysunlinkat+0x3c/0x90 invokesyscall+0x48/0x134 doel0svc+0x1c/0x30prop.0+0xd0/0xf0
[mani: cced stable, changed commit message as per https://lore.kernel.org/linux-pci/aV9joi3jF1R6ca02@ryzen]
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the Linux kernel PCI endpoint subsystem and performing configfs unlink operations involving primary or secondary EPC/EPF links are exposed. The reported failure occurs when the unlink command is used in configfs.
What access does an attacker need to trigger the crash?
The CVSS vector indicates local access with low privileges and no user interaction is required. Triggering the issue requires reaching the affected configfs unlink path.
What is the impact of successful exploitation?
The incorrect callback parameter ordering can cause a kernel paging-request crash during unlink processing. The CVSS assessment identifies the impact as high availability impact, with no confidentiality or integrity impact.
What should administrators do if their systems use this functionality?
Apply an available Linux kernel patch containing the fix. If patching cannot be performed immediately, avoid configfs unlink operations for the affected PCI endpoint primary or secondary EPC/EPF links.