CVE-2026-43232: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets

Published May 6, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets

When the FarSync T-series card is being detached, the fstcardinfo is deallocated in fstremoveone(). However, the fsttxtask or fstinttask may still be running or pending, leading to use-after-free bugs when the already freed fstcardinfo is accessed in fstprocesstxworkq() or fstprocessintworkq().

A typical race condition is depicted below:

CPU 0 (cleanup) | CPU 1 (tasklet) | fststartxmit() fstremoveone() | taskletschedule() unregisterhdlcdevice()| | fstprocesstxworkq() //handler kfree(card) //free | dobottomhalftx() | card-> //use

The following KASAN trace was captured:

================================================================== BUG: KASAN: slab-use-after-free in dobottomhalftx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: <IRQ> dumpstacklvl+0x55/0x70 printreport+0xcb/0x5d0 ? dobottomhalftx+0xb88/0xd00 kasanreport+0xb8/0xf0 ? dobottomhalftx+0xb88/0xd00 dobottomhalftx+0xb88/0xd00 ? rawspinlockirqsave+0x85/0xe0 ? pfxrawspinlockirqsave+0x10/0x10 ? pfxhrtimerrunqueues+0x10/0x10 fstprocesstxworkq+0x67/0x90 taskletactioncommon+0x1fa/0x720 ? hrtimerinterrupt+0x31f/0x780 handlesoftirqs+0x176/0x530 irqexitrcu+0xab/0xe0 sysvecapictimerinterrupt+0x70/0x80 ...

Allocated by task 41 on cpu 3 at 72.330843s: kasansavestack+0x24/0x50 kasansavetrack+0x17/0x60 kasankmalloc+0x7f/0x90 fstaddone+0x1a5/0x1cd0 localpciprobe+0xdd/0x190 pcideviceprobe+0x341/0x480 reallyprobe+0x1c6/0x6a0 driverprobedevice+0x248/0x310 driverprobedevice+0x48/0x210 deviceattachdriver+0x160/0x320 busforeachdrv+0x101/0x190 deviceattach+0x198/0x3a0 deviceinitialprobe+0x78/0xa0 pcibusadddevice+0x81/0xc0 pcibusadddevices+0x7e/0x190 enableslot+0x9b9/0x1130 acpiphpcheckbridge.part.0+0x2e1/0x460 acpiphphotplugnotify+0x36c/0x3c0 acpidevicehotplug+0x203/0xb10 acpihotplugworkfn+0x59/0x80 ...

Freed by task 41 on cpu 1 at 75.138639s: kasansavestack+0x24/0x50 kasansavetrack+0x17/0x60 kasansavefreeinfo+0x3b/0x60 kasanslabfree+0x43/0x70 kfree+0x135/0x410 fstremoveone+0x2ca/0x540 pcideviceremove+0xa6/0x1d0 devicereleasedriverinternal+0x364/0x530 pcistopbusdevice+0x105/0x150 pcistopandremovebusdevice+0xd/0x20 disableslot+0x116/0x260 acpiphpdisableandejectslot+0x4b/0x190 acpiphphotplugnotify+0x230/0x3c0 acpidevicehotplug+0x203/0xb10 acpihotplugworkfn+0x59/0x80 ...

The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entiremapcount:0 nrpagesmapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) pagetype: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800aad1000: fa fb ---truncated---

Affected Software

14 affected components
Linux Linux kernel
Linux Linux kernel>=4.9.337<4.10
Linux Linux kernel>=4.14.303<4.15
Linux Linux kernel>=4.19.270<4.20
Linux Linux kernel>=5.4.229<5.5
Linux Linux kernel>=5.10.163<5.10.252
Linux Linux kernel>=5.15.86<5.15.202
Linux Linux kernel>=6.0.16<6.1
Linux Linux kernel>=6.1.2<6.1.165
Linux Linux kernel>=6.2<6.6.128
Linux Linux kernel>=6.7<6.12.75
Linux Linux kernel>=6.13<6.18.16
Linux Linux kernel>=6.19<6.19.6
Linux Linux kernel=7.0-rc1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119~20.04.1
  2. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126~20.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126~20.04.2
  4. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122~20.04.1
  5. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196~20.04.1
  6. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110~20.04.1
  7. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.113~20.04.1
  8. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-184.194~20.04.1
  9. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1064.66~20.04.1
  10. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.115~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110~20.04.1
  12. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196
  13. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119
  14. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63~22.04.1
  15. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126
  16. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71~22.04.1
  17. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126
  18. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69~22.04.1
  19. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122
  20. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.69~22.04.1
  21. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1108.114
  22. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1095.103
  23. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136~22.04.1
  24. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110
  25. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.61~22.04.1
  26. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.113
  27. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.109
  28. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-184.194
  29. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-134.134.1~22.04.1
  30. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.108
  31. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61~22.04.1
  32. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1064.66
  33. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1053.53
  34. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.115
  35. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.58~22.04.1
  36. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.109
  37. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-134.134~22.04.1
  38. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.79
  39. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1096.98
  40. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.106
  41. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1111.120
  42. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1055.56~22.04.1
  43. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119+fips1
  44. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126+fips1
  45. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196+fips1
  46. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122+fips1
  47. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-134.134
  48. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63
  49. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71
  50. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69
  51. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.69
  52. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.64
  53. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1045.48
  54. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.61
  55. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-134.134.1
  56. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61
  57. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61.1
  58. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.30
  59. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1057.58
  60. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.64
  61. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1032.33
  62. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.30
  63. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2049.50
  64. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1055.56
  65. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1060.63+fips1
  66. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69+fips1
  67. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-134.134+fips1
  68. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.69+fips1

Event History

May 6, 2026
CVE Published
via MITRE·11:28 AM
Data Sourced
via MITRE·11:28 AM
DescriptionSeverity
Data Sourced
via NVD·12:16 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-43232?

CVE-2026-43232 has a high severity rating due to its potential to cause use-after-free vulnerabilities in the Linux kernel.

2

How do I fix CVE-2026-43232?

To fix CVE-2026-43232, ensure that you update your Linux kernel to the latest patched version released by the maintainers.

3

What software is affected by CVE-2026-43232?

CVE-2026-43232 affects the Linux kernel, specifically related to the FarSync T-series card.

4

What type of vulnerability is CVE-2026-43232?

CVE-2026-43232 is categorized as a use-after-free vulnerability that can lead to system instability or exploitation.

5

When was CVE-2026-43232 disclosed?

CVE-2026-43232 was disclosed as part of a security update in 2026.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203