CVE-2026-43232 (GCVE-0-2026-43232)
Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-05-08 12:41
VLAI?
Title
net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
When the FarSync T-series card is being detached, the fst_card_info is
deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task
may still be running or pending, leading to use-after-free bugs when the
already freed fst_card_info is accessed in fst_process_tx_work_q() or
fst_process_int_work_q().
A typical race condition is depicted below:
CPU 0 (cleanup) | CPU 1 (tasklet)
| fst_start_xmit()
fst_remove_one() | tasklet_schedule()
unregister_hdlc_device()|
| fst_process_tx_work_q() //handler
kfree(card) //free | do_bottom_half_tx()
| card-> //use
The following KASAN trace was captured:
==================================================================
BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00
Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32
...
Call Trace:
<IRQ>
dump_stack_lvl+0x55/0x70
print_report+0xcb/0x5d0
? do_bottom_half_tx+0xb88/0xd00
kasan_report+0xb8/0xf0
? do_bottom_half_tx+0xb88/0xd00
do_bottom_half_tx+0xb88/0xd00
? _raw_spin_lock_irqsave+0x85/0xe0
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx___hrtimer_run_queues+0x10/0x10
fst_process_tx_work_q+0x67/0x90
tasklet_action_common+0x1fa/0x720
? hrtimer_interrupt+0x31f/0x780
handle_softirqs+0x176/0x530
__irq_exit_rcu+0xab/0xe0
sysvec_apic_timer_interrupt+0x70/0x80
...
Allocated by task 41 on cpu 3 at 72.330843s:
kasan_save_stack+0x24/0x50
kasan_save_track+0x17/0x60
__kasan_kmalloc+0x7f/0x90
fst_add_one+0x1a5/0x1cd0
local_pci_probe+0xdd/0x190
pci_device_probe+0x341/0x480
really_probe+0x1c6/0x6a0
__driver_probe_device+0x248/0x310
driver_probe_device+0x48/0x210
__device_attach_driver+0x160/0x320
bus_for_each_drv+0x101/0x190
__device_attach+0x198/0x3a0
device_initial_probe+0x78/0xa0
pci_bus_add_device+0x81/0xc0
pci_bus_add_devices+0x7e/0x190
enable_slot+0x9b9/0x1130
acpiphp_check_bridge.part.0+0x2e1/0x460
acpiphp_hotplug_notify+0x36c/0x3c0
acpi_device_hotplug+0x203/0xb10
acpi_hotplug_work_fn+0x59/0x80
...
Freed by task 41 on cpu 1 at 75.138639s:
kasan_save_stack+0x24/0x50
kasan_save_track+0x17/0x60
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kfree+0x135/0x410
fst_remove_one+0x2ca/0x540
pci_device_remove+0xa6/0x1d0
device_release_driver_internal+0x364/0x530
pci_stop_bus_device+0x105/0x150
pci_stop_and_remove_bus_device+0xd/0x20
disable_slot+0x116/0x260
acpiphp_disable_and_eject_slot+0x4b/0x190
acpiphp_hotplug_notify+0x230/0x3c0
acpi_device_hotplug+0x203/0xb10
acpi_hotplug_work_fn+0x59/0x80
...
The buggy address belongs to the object at ffff88800aad1000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 28 bytes inside of
freed 1024-byte region
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800aad1000: fa fb
---truncated---
Severity ?
8.8 (High)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
51e2d1b84acac39f79cacb60e6e154ce00a9d308 , < cac048ebfbb92d91d719f74b59177cb70a7633b8
(git)
Affected: 998b4e54f517961d3d75144c088a24423e003005 , < 086131807d119238cd464e5b0845e48d938dfd79 (git) Affected: bb1715a6bfb0c57a68524732a376498a2569f016 , < ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 337d7b4112a47984ee319171b75b73bab47e7924 (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 200bdb8d367ca9b478f9c56ebe56411604d55c81 (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 21d341fe514fd07e345ed264c9eee21cb2061ca2 (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < 04edfdfdfcdefc02408ab670607261b0a0a9a02e (git) Affected: 2f623aaf9f31de968dea6169849706a2f9be444c , < bae8a5d2e759da2e0cba33ab2080deee96a09373 (git) Affected: 41798a063fd4721b609e11ad839b6820f5070ca7 (git) Affected: b1fe377b43c405b169cffd1b3aa39c1dde16f3ed (git) Affected: ce9dc768767bbe73d2dd330a9075e849cb8a84d4 (git) Affected: 0c5f2c7700cb18aeab1574588d3bb9c0454bf228 (git) Affected: 024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wan/farsync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cac048ebfbb92d91d719f74b59177cb70a7633b8",
"status": "affected",
"version": "51e2d1b84acac39f79cacb60e6e154ce00a9d308",
"versionType": "git"
},
{
"lessThan": "086131807d119238cd464e5b0845e48d938dfd79",
"status": "affected",
"version": "998b4e54f517961d3d75144c088a24423e003005",
"versionType": "git"
},
{
"lessThan": "ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc",
"status": "affected",
"version": "bb1715a6bfb0c57a68524732a376498a2569f016",
"versionType": "git"
},
{
"lessThan": "337d7b4112a47984ee319171b75b73bab47e7924",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "200bdb8d367ca9b478f9c56ebe56411604d55c81",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "21d341fe514fd07e345ed264c9eee21cb2061ca2",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "04edfdfdfcdefc02408ab670607261b0a0a9a02e",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "bae8a5d2e759da2e0cba33ab2080deee96a09373",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"status": "affected",
"version": "41798a063fd4721b609e11ad839b6820f5070ca7",
"versionType": "git"
},
{
"status": "affected",
"version": "b1fe377b43c405b169cffd1b3aa39c1dde16f3ed",
"versionType": "git"
},
{
"status": "affected",
"version": "ce9dc768767bbe73d2dd330a9075e849cb8a84d4",
"versionType": "git"
},
{
"status": "affected",
"version": "0c5f2c7700cb18aeab1574588d3bb9c0454bf228",
"versionType": "git"
},
{
"status": "affected",
"version": "024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wan/farsync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.303",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup) | CPU 1 (tasklet)\n | fst_start_xmit()\nfst_remove_one() | tasklet_schedule()\n unregister_hdlc_device()|\n | fst_process_tx_work_q() //handler\n kfree(card) //free | do_bottom_half_tx()\n | card-\u003e //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x55/0x70\n print_report+0xcb/0x5d0\n ? do_bottom_half_tx+0xb88/0xd00\n kasan_report+0xb8/0xf0\n ? do_bottom_half_tx+0xb88/0xd00\n do_bottom_half_tx+0xb88/0xd00\n ? _raw_spin_lock_irqsave+0x85/0xe0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx___hrtimer_run_queues+0x10/0x10\n fst_process_tx_work_q+0x67/0x90\n tasklet_action_common+0x1fa/0x720\n ? hrtimer_interrupt+0x31f/0x780\n handle_softirqs+0x176/0x530\n __irq_exit_rcu+0xab/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0x7f/0x90\n fst_add_one+0x1a5/0x1cd0\n local_pci_probe+0xdd/0x190\n pci_device_probe+0x341/0x480\n really_probe+0x1c6/0x6a0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x48/0x210\n __device_attach_driver+0x160/0x320\n bus_for_each_drv+0x101/0x190\n __device_attach+0x198/0x3a0\n device_initial_probe+0x78/0xa0\n pci_bus_add_device+0x81/0xc0\n pci_bus_add_devices+0x7e/0x190\n enable_slot+0x9b9/0x1130\n acpiphp_check_bridge.part.0+0x2e1/0x460\n acpiphp_hotplug_notify+0x36c/0x3c0\n acpi_device_hotplug+0x203/0xb10\n acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x135/0x410\n fst_remove_one+0x2ca/0x540\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0x364/0x530\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device+0xd/0x20\n disable_slot+0x116/0x260\n acpiphp_disable_and_eject_slot+0x4b/0x190\n acpiphp_hotplug_notify+0x230/0x3c0\n acpi_device_hotplug+0x203/0xb10\n acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff88800aad1000: fa fb\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T12:41:27.008Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"
},
{
"url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"
},
{
"url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"
},
{
"url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"
},
{
"url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"
},
{
"url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"
},
{
"url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"
},
{
"url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"
}
],
"title": "net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43232",
"datePublished": "2026-05-06T11:28:28.910Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-05-08T12:41:27.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-43232",
"date": "2026-05-09",
"epss": "0.00045",
"percentile": "0.13711"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-43232\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:43.223\",\"lastModified\":\"2026-05-08T13:16:46.530\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\\n\\nWhen the FarSync T-series card is being detached, the fst_card_info is\\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\\nmay still be running or pending, leading to use-after-free bugs when the\\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\\nfst_process_int_work_q().\\n\\nA typical race condition is depicted below:\\n\\nCPU 0 (cleanup) | CPU 1 (tasklet)\\n | fst_start_xmit()\\nfst_remove_one() | tasklet_schedule()\\n unregister_hdlc_device()|\\n | fst_process_tx_work_q() //handler\\n kfree(card) //free | do_bottom_half_tx()\\n | card-\u003e //use\\n\\nThe following KASAN trace was captured:\\n\\n==================================================================\\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\\n ...\\n Call Trace:\\n \u003cIRQ\u003e\\n dump_stack_lvl+0x55/0x70\\n print_report+0xcb/0x5d0\\n ? do_bottom_half_tx+0xb88/0xd00\\n kasan_report+0xb8/0xf0\\n ? do_bottom_half_tx+0xb88/0xd00\\n do_bottom_half_tx+0xb88/0xd00\\n ? _raw_spin_lock_irqsave+0x85/0xe0\\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n ? __pfx___hrtimer_run_queues+0x10/0x10\\n fst_process_tx_work_q+0x67/0x90\\n tasklet_action_common+0x1fa/0x720\\n ? hrtimer_interrupt+0x31f/0x780\\n handle_softirqs+0x176/0x530\\n __irq_exit_rcu+0xab/0xe0\\n sysvec_apic_timer_interrupt+0x70/0x80\\n ...\\n\\n Allocated by task 41 on cpu 3 at 72.330843s:\\n kasan_save_stack+0x24/0x50\\n kasan_save_track+0x17/0x60\\n __kasan_kmalloc+0x7f/0x90\\n fst_add_one+0x1a5/0x1cd0\\n local_pci_probe+0xdd/0x190\\n pci_device_probe+0x341/0x480\\n really_probe+0x1c6/0x6a0\\n __driver_probe_device+0x248/0x310\\n driver_probe_device+0x48/0x210\\n __device_attach_driver+0x160/0x320\\n bus_for_each_drv+0x101/0x190\\n __device_attach+0x198/0x3a0\\n device_initial_probe+0x78/0xa0\\n pci_bus_add_device+0x81/0xc0\\n pci_bus_add_devices+0x7e/0x190\\n enable_slot+0x9b9/0x1130\\n acpiphp_check_bridge.part.0+0x2e1/0x460\\n acpiphp_hotplug_notify+0x36c/0x3c0\\n acpi_device_hotplug+0x203/0xb10\\n acpi_hotplug_work_fn+0x59/0x80\\n ...\\n\\n Freed by task 41 on cpu 1 at 75.138639s:\\n kasan_save_stack+0x24/0x50\\n kasan_save_track+0x17/0x60\\n kasan_save_free_info+0x3b/0x60\\n __kasan_slab_free+0x43/0x70\\n kfree+0x135/0x410\\n fst_remove_one+0x2ca/0x540\\n pci_device_remove+0xa6/0x1d0\\n device_release_driver_internal+0x364/0x530\\n pci_stop_bus_device+0x105/0x150\\n pci_stop_and_remove_bus_device+0xd/0x20\\n disable_slot+0x116/0x260\\n acpiphp_disable_and_eject_slot+0x4b/0x190\\n acpiphp_hotplug_notify+0x230/0x3c0\\n acpi_device_hotplug+0x203/0xb10\\n acpi_hotplug_work_fn+0x59/0x80\\n ...\\n\\n The buggy address belongs to the object at ffff88800aad1000\\n which belongs to the cache kmalloc-1k of size 1024\\n The buggy address is located 28 bytes inside of\\n freed 1024-byte region\\n The buggy address belongs to the physical page:\\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\n flags: 0x100000000000040(head|node=0|zone=1)\\n page_type: f5(slab)\\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n \u003effff88800aad1000: fa fb\\n---truncated---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…