CVE-2026-43232 (GCVE-0-2026-43232)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-05-23 16:06
VLAI
Title
net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
Summary
In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs when the already freed fst_card_info is accessed in fst_process_tx_work_q() or fst_process_int_work_q(). A typical race condition is depicted below: CPU 0 (cleanup) | CPU 1 (tasklet) | fst_start_xmit() fst_remove_one() | tasklet_schedule() unregister_hdlc_device()| | fst_process_tx_work_q() //handler kfree(card) //free | do_bottom_half_tx() | card-> //use The following KASAN trace was captured: ================================================================== BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 ? do_bottom_half_tx+0xb88/0xd00 kasan_report+0xb8/0xf0 ? do_bottom_half_tx+0xb88/0xd00 do_bottom_half_tx+0xb88/0xd00 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx___hrtimer_run_queues+0x10/0x10 fst_process_tx_work_q+0x67/0x90 tasklet_action_common+0x1fa/0x720 ? hrtimer_interrupt+0x31f/0x780 handle_softirqs+0x176/0x530 __irq_exit_rcu+0xab/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 41 on cpu 3 at 72.330843s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 fst_add_one+0x1a5/0x1cd0 local_pci_probe+0xdd/0x190 pci_device_probe+0x341/0x480 really_probe+0x1c6/0x6a0 __driver_probe_device+0x248/0x310 driver_probe_device+0x48/0x210 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x101/0x190 __device_attach+0x198/0x3a0 device_initial_probe+0x78/0xa0 pci_bus_add_device+0x81/0xc0 pci_bus_add_devices+0x7e/0x190 enable_slot+0x9b9/0x1130 acpiphp_check_bridge.part.0+0x2e1/0x460 acpiphp_hotplug_notify+0x36c/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... Freed by task 41 on cpu 1 at 75.138639s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x135/0x410 fst_remove_one+0x2ca/0x540 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0x364/0x530 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device+0xd/0x20 disable_slot+0x116/0x260 acpiphp_disable_and_eject_slot+0x4b/0x190 acpiphp_hotplug_notify+0x230/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800aad1000: fa fb ---truncated---
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 51e2d1b84acac39f79cacb60e6e154ce00a9d308 , < cac048ebfbb92d91d719f74b59177cb70a7633b8 (git)
Affected: 998b4e54f517961d3d75144c088a24423e003005 , < 086131807d119238cd464e5b0845e48d938dfd79 (git)
Affected: bb1715a6bfb0c57a68524732a376498a2569f016 , < ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc (git)
Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 337d7b4112a47984ee319171b75b73bab47e7924 (git)
Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 200bdb8d367ca9b478f9c56ebe56411604d55c81 (git)
Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 21d341fe514fd07e345ed264c9eee21cb2061ca2 (git)
Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 04edfdfdfcdefc02408ab670607261b0a0a9a02e (git)
Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < bae8a5d2e759da2e0cba33ab2080deee96a09373 (git)
Affected: 41798a063fd4721b609e11ad839b6820f5070ca7 (git)
Affected: b1fe377b43c405b169cffd1b3aa39c1dde16f3ed (git)
Affected: ce9dc768767bbe73d2dd330a9075e849cb8a84d4 (git)
Affected: 0c5f2c7700cb18aeab1574588d3bb9c0454bf228 (git)
Affected: 024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9 (git)
Affected: 5.10.163 , < 5.10.252 (semver)
Affected: 5.15.86 , < 5.15.202 (semver)
Affected: 6.1.2 , < 6.1.165 (semver)
Affected: 4.9.337 , < 4.10 (semver)
Affected: 4.14.303 , < 4.15 (semver)
Affected: 4.19.270 , < 4.20 (semver)
Affected: 5.4.229 , < 5.5 (semver)
Affected: 6.0.16 , < 6.1 (semver)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 5.10.252 , ≤ 5.10.* (semver)
Unaffected: 5.15.202 , ≤ 5.15.* (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wan/farsync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cac048ebfbb92d91d719f74b59177cb70a7633b8",
              "status": "affected",
              "version": "51e2d1b84acac39f79cacb60e6e154ce00a9d308",
              "versionType": "git"
            },
            {
              "lessThan": "086131807d119238cd464e5b0845e48d938dfd79",
              "status": "affected",
              "version": "998b4e54f517961d3d75144c088a24423e003005",
              "versionType": "git"
            },
            {
              "lessThan": "ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc",
              "status": "affected",
              "version": "bb1715a6bfb0c57a68524732a376498a2569f016",
              "versionType": "git"
            },
            {
              "lessThan": "337d7b4112a47984ee319171b75b73bab47e7924",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "200bdb8d367ca9b478f9c56ebe56411604d55c81",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "21d341fe514fd07e345ed264c9eee21cb2061ca2",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "04edfdfdfcdefc02408ab670607261b0a0a9a02e",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "lessThan": "bae8a5d2e759da2e0cba33ab2080deee96a09373",
              "status": "affected",
              "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "41798a063fd4721b609e11ad839b6820f5070ca7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1fe377b43c405b169cffd1b3aa39c1dde16f3ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce9dc768767bbe73d2dd330a9075e849cb8a84d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c5f2c7700cb18aeab1574588d3bb9c0454bf228",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.252",
              "status": "affected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.202",
              "status": "affected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.165",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wan/farsync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.10.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.15.86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "6.1.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.337",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.303",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.270",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.229",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-\u003e //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  \u003cIRQ\u003e\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff88800aad1000: fa fb\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:06:31.895Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"
        },
        {
          "url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"
        },
        {
          "url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"
        },
        {
          "url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"
        }
      ],
      "title": "net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43232",
    "datePublished": "2026-05-06T11:28:28.910Z",
    "dateReserved": "2026-05-01T14:12:55.995Z",
    "dateUpdated": "2026-05-23T16:06:31.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43232",
      "date": "2026-06-11",
      "epss": "0.00053",
      "percentile": "0.16898"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43232\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:43.223\",\"lastModified\":\"2026-05-12T19:08:04.757\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\\n\\nWhen the FarSync T-series card is being detached, the fst_card_info is\\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\\nmay still be running or pending, leading to use-after-free bugs when the\\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\\nfst_process_int_work_q().\\n\\nA typical race condition is depicted below:\\n\\nCPU 0 (cleanup)           | CPU 1 (tasklet)\\n                          | fst_start_xmit()\\nfst_remove_one()          |   tasklet_schedule()\\n  unregister_hdlc_device()|\\n                          | fst_process_tx_work_q() //handler\\n  kfree(card) //free      |   do_bottom_half_tx()\\n                          |     card-\u003e //use\\n\\nThe following KASAN trace was captured:\\n\\n==================================================================\\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\\n ...\\n Call Trace:\\n  \u003cIRQ\u003e\\n  dump_stack_lvl+0x55/0x70\\n  print_report+0xcb/0x5d0\\n  ? do_bottom_half_tx+0xb88/0xd00\\n  kasan_report+0xb8/0xf0\\n  ? do_bottom_half_tx+0xb88/0xd00\\n  do_bottom_half_tx+0xb88/0xd00\\n  ? _raw_spin_lock_irqsave+0x85/0xe0\\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  ? __pfx___hrtimer_run_queues+0x10/0x10\\n  fst_process_tx_work_q+0x67/0x90\\n  tasklet_action_common+0x1fa/0x720\\n  ? hrtimer_interrupt+0x31f/0x780\\n  handle_softirqs+0x176/0x530\\n  __irq_exit_rcu+0xab/0xe0\\n  sysvec_apic_timer_interrupt+0x70/0x80\\n ...\\n\\n Allocated by task 41 on cpu 3 at 72.330843s:\\n  kasan_save_stack+0x24/0x50\\n  kasan_save_track+0x17/0x60\\n  __kasan_kmalloc+0x7f/0x90\\n  fst_add_one+0x1a5/0x1cd0\\n  local_pci_probe+0xdd/0x190\\n  pci_device_probe+0x341/0x480\\n  really_probe+0x1c6/0x6a0\\n  __driver_probe_device+0x248/0x310\\n  driver_probe_device+0x48/0x210\\n  __device_attach_driver+0x160/0x320\\n  bus_for_each_drv+0x101/0x190\\n  __device_attach+0x198/0x3a0\\n  device_initial_probe+0x78/0xa0\\n  pci_bus_add_device+0x81/0xc0\\n  pci_bus_add_devices+0x7e/0x190\\n  enable_slot+0x9b9/0x1130\\n  acpiphp_check_bridge.part.0+0x2e1/0x460\\n  acpiphp_hotplug_notify+0x36c/0x3c0\\n  acpi_device_hotplug+0x203/0xb10\\n  acpi_hotplug_work_fn+0x59/0x80\\n ...\\n\\n Freed by task 41 on cpu 1 at 75.138639s:\\n  kasan_save_stack+0x24/0x50\\n  kasan_save_track+0x17/0x60\\n  kasan_save_free_info+0x3b/0x60\\n  __kasan_slab_free+0x43/0x70\\n  kfree+0x135/0x410\\n  fst_remove_one+0x2ca/0x540\\n  pci_device_remove+0xa6/0x1d0\\n  device_release_driver_internal+0x364/0x530\\n  pci_stop_bus_device+0x105/0x150\\n  pci_stop_and_remove_bus_device+0xd/0x20\\n  disable_slot+0x116/0x260\\n  acpiphp_disable_and_eject_slot+0x4b/0x190\\n  acpiphp_hotplug_notify+0x230/0x3c0\\n  acpi_device_hotplug+0x203/0xb10\\n  acpi_hotplug_work_fn+0x59/0x80\\n ...\\n\\n The buggy address belongs to the object at ffff88800aad1000\\n  which belongs to the cache kmalloc-1k of size 1024\\n The buggy address is located 28 bytes inside of\\n  freed 1024-byte region\\n The buggy address belongs to the physical page:\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\n flags: 0x100000000000040(head|node=0|zone=1)\\n page_type: f5(slab)\\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n \u003effff88800aad1000: fa fb\\n---truncated---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.337\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"0C8C5100-ECF6-4F64-9489-EFC7923A7591\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.303\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"68B456F6-323E-4372-A707-523AAA068DF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.270\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"C08F8902-A527-4C5E-A1BC-1DA79FBF4CB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.229\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"591759E0-9179-476B-B922-DD6AA7773219\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.163\",\"versionEndExcluding\":\"5.10.252\",\"matchCriteriaId\":\"1D2D6DEE-F438-44A6-8330-B2B230EF7798\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.86\",\"versionEndExcluding\":\"5.15.202\",\"matchCriteriaId\":\"944E0E69-FFE6-4BC9-B05F-AA316D9370A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.16\",\"versionEndExcluding\":\"6.1\",\"matchCriteriaId\":\"6C7522E3-150F-436D-BBD7-96C7B4B795ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.2\",\"versionEndExcluding\":\"6.1.165\",\"matchCriteriaId\":\"ED6D1FF0-31EB-453B-8BF3-1CDCB55AC3EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.