Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-43203

atm: fore200e: fix use-after-free in tasklets during device removal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: atm: fore200e: fix use-after-free in tasklets during device removal When the PCA-200E or SBA-200E adapter is being detached, the fore200e is deallocated. However, the tx_tasklet or rx_tasklet may still be running or pending, leading to use-after-free bug when the already freed fore200e is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet(). One of the race conditions can occur as follows: CPU 0 (cleanup) | CPU 1 (tasklet) fore200e_pca_remove_one() | fore200e_interrupt() fore200e_shutdown() | tasklet_schedule() kfree(fore200e) | fore200e_tx_tasklet() | fore200e-> // UAF Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to synchronize with any pending or running tasklets. Moreover, since fore200e_reset() could prevent further interrupts or data transfers, the tasklet_kill() should be placed after fore200e_reset() to prevent the tasklet from being rescheduled in fore200e_interrupt(). Finally, it only needs to do tasklet_kill() when the fore200e state is greater than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized in earlier states. In a word, the tasklet_kill() should be placed in the FORE200E_STATE_IRQ branch within the switch...case structure. This bug was identified through static analysis.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 91f25749aaf57c47ae1e12478144e6ea8c8562f2affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 73fbc5d1a9ccb626937500bbd67136f077d8237baffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < aba0b4bc09376dfc3d53c826514fe38fc8337f52affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e075ec9b08f862dade8011481058f7eb5f716c57affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 97900f512252a59f23d6ce4ab215cc88fed66e68affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e4ff4e3ffcf9d5aad380cdd1d8cdc008bb34f97daffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5189368f10903956be05062d160b2804bf5e5016affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8930878101cd40063888a68af73b1b0f8b6c79bcaffected

Linux Linux

Default version status: affected

  • 2.6.12affected
  • 0 to < 2.6.12unaffected
  • 5.10.252 to ≤ 5.10.*unaffected
  • 5.15.202 to ≤ 5.15.*unaffected
  • 6.1.165 to ≤ 6.1.*unaffected
  • 6.6.128 to ≤ 6.6.*unaffected
  • 6.12.75 to ≤ 6.12.*unaffected
  • 6.18.16 to ≤ 6.18.*unaffected
  • 6.19.6 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References