CVE-2026-43203: atm: fore200e: fix use-after-free in tasklets during device removal
In the Linux kernel, the following vulnerability has been resolved:
atm: fore200e: fix use-after-free in tasklets during device removal
When the PCA-200E or SBA-200E adapter is being detached, the fore200e is deallocated. However, the txtasklet or rxtasklet may still be running or pending, leading to use-after-free bug when the already freed fore200e is accessed again in fore200etxtasklet() or fore200erxtasklet().
One of the race conditions can occur as follows:
CPU 0 (cleanup) | CPU 1 (tasklet) fore200epcaremoveone() | fore200einterrupt() fore200eshutdown() | taskletschedule() kfree(fore200e) | fore200etxtasklet() | fore200e-> // UAF
Fix this by ensuring txtasklet or rxtasklet is properly canceled before the fore200e is released. Add taskletkill() in fore200eshutdown() to synchronize with any pending or running tasklets. Moreover, since fore200ereset() could prevent further interrupts or data transfers, the taskletkill() should be placed after fore200ereset() to prevent the tasklet from being rescheduled in fore200einterrupt(). Finally, it only needs to do taskletkill() when the fore200e state is greater than or equal to FORE200ESTATEIRQ, since tasklets are uninitialized in earlier states. In a word, the taskletkill() should be placed in the FORE200ESTATEIRQ branch within the switch...case structure.
This bug was identified through static analysis.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In fore200e_shutdown(), ensure tx_tasklet or rx_tasklet are properly canceled by calling tasklet_kill() after fore200e_reset(). Only invoke tasklet_kill() when the fore200e state is greater than or equal to FORE200E_STATE_IRQ (i.e., in the FORE200E_STATE_IRQ branch of the switch-case), so that pending/running tasklets are synchronized with device removal and cannot access fore200e after it is deallocated.
Linux kernel module fore200e (PCA-200E/SBA-200E adapter) tasklet_kill() placement in fore200e_shutdown() = Place tasklet_kill() after fore200e_reset() and only when state >= FORE200E_STATE_IRQ (within the FORE200E_STATE_IRQ branch) to prevent UAF/race where tx_tasklet or rx_tasklet can reschedule and access freed fore200e
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43203?
The severity of CVE-2026-43203 is significant due to the potential for use-after-free vulnerabilities leading to system instability or attacker exploitation.
How do I fix CVE-2026-43203?
To fix CVE-2026-43203, update the Linux kernel to the latest version where this vulnerability has been addressed.
Who is affected by CVE-2026-43203?
CVE-2026-43203 affects users running systems with the Linux fore200e driver specifically involving PCA-200E or SBA-200E adapters.
What are the symptoms of CVE-2026-43203?
Symptoms of CVE-2026-43203 may include system crashes or unexpected behavior during the removal of affected devices.
When was CVE-2026-43203 published?
CVE-2026-43203 was published in 2026 after being identified in the Linux kernel regarding the fore200e driver.