In the Linux kernel, the following vulnerability has been resolved:
atm: fore200e: fix use-after-free in tasklets during device removal
When the PCA-200E or SBA-200E adapter is being detached, the fore200e
is deallocated. However, the tx_tasklet or rx_tasklet may still be running
or pending, leading to use-after-free bug when the already freed fore200e
is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().
One of the race conditions can occur as follows:
CPU 0 (cleanup) | CPU 1 (tasklet)
fore200e_pca_remove_one() | fore200e_interrupt()
fore200e_shutdown() | tasklet_schedule()
kfree(fore200e) | fore200e_tx_tasklet()
| fore200e-> // UAF
Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before
the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to
synchronize with any pending or running tasklets. Moreover, since
fore200e_reset() could prevent further interrupts or data transfers,
the tasklet_kill() should be placed after fore200e_reset() to prevent
the tasklet from being rescheduled in fore200e_interrupt(). Finally,
it only needs to do tasklet_kill() when the fore200e state is greater
than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized
in earlier states. In a word, the tasklet_kill() should be placed in
the FORE200E_STATE_IRQ branch within the switch...case structure.
This bug was identified through static analysis.
References
Configurations
Configuration 1 (hide)
|
History
11 May 2026, 20:10
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| References | () https://git.kernel.org/stable/c/5189368f10903956be05062d160b2804bf5e5016 - Patch | |
| References | () https://git.kernel.org/stable/c/73fbc5d1a9ccb626937500bbd67136f077d8237b - Patch | |
| References | () https://git.kernel.org/stable/c/8930878101cd40063888a68af73b1b0f8b6c79bc - Patch | |
| References | () https://git.kernel.org/stable/c/91f25749aaf57c47ae1e12478144e6ea8c8562f2 - Patch | |
| References | () https://git.kernel.org/stable/c/97900f512252a59f23d6ce4ab215cc88fed66e68 - Patch | |
| References | () https://git.kernel.org/stable/c/aba0b4bc09376dfc3d53c826514fe38fc8337f52 - Patch | |
| References | () https://git.kernel.org/stable/c/e075ec9b08f862dade8011481058f7eb5f716c57 - Patch | |
| References | () https://git.kernel.org/stable/c/e4ff4e3ffcf9d5aad380cdd1d8cdc008bb34f97d - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
08 May 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
06 May 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-06 12:16
Updated : 2026-05-11 20:10
NVD link : CVE-2026-43203
Mitre link : CVE-2026-43203
CVE.ORG link : CVE-2026-43203
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free