CVE-2026-43004: Linux Kernel Resource Leak Vulnerability

CVE-2026-43004 Overview

CVE-2026-43004 is a resource leak vulnerability in the Linux kernel spi-stm32-ospi driver, which provides Octal Serial Peripheral Interface (OSPI) support for STMicroelectronics STM32 platforms. The flaw exists in the driver's remove() callback, which returns early when pm_runtime_resume_and_get() fails. This early exit skips the cleanup of the SPI controller and other associated resources, leading to a kernel resource leak when the device is unbound or the module is unloaded under power management failure conditions.

Critical Impact
When runtime power management resume fails during driver removal, kernel resources tied to the SPI controller remain allocated, causing a leak that can affect kernel stability on affected STM32-based systems.

Affected Products

Linux kernel versions containing the spi-stm32-ospi driver prior to the fix
STMicroelectronics STM32 platforms using the OSPI subsystem
Linux stable branches receiving the backported patches identified by commits 0807532c, 73cd1f97, and b4ec54c9

Discovery Timeline

2026-05-01 - CVE-2026-43004 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43004

Vulnerability Analysis

The vulnerability resides in the remove() callback of the spi-stm32-ospi driver in the Linux kernel. The callback invokes pm_runtime_resume_and_get() to bring the device back to an active state before performing teardown. When this call fails, the original implementation returns early from remove() without unregistering the SPI controller or releasing related resources.

This behavior leaves controller registrations, memory allocations, and clock or regulator references in place after the driver believes it has detached from the device. Subsequent re-binding attempts or kernel operations referencing those orphaned structures can produce unstable behavior. The defect falls under the category of Memory Leak and Resource Exhaustion vulnerabilities in kernel driver teardown logic.

Root Cause

The root cause is incorrect error-handling flow in the driver's removal path. The remove() callback treats a failed runtime PM resume as a terminal condition and exits, instead of treating it as a degraded condition where cleanup must still proceed. Because remove() is the final opportunity to release driver-owned resources, an early return at this stage guarantees that any allocations bound to the device remain allocated for the lifetime of the kernel.

Attack Vector

The issue is not a remotely exploitable flaw. It is triggered locally when the spi-stm32-ospi driver is unbound or the module is removed while the device's power management state cannot be resumed. Triggering the condition typically requires privileged access to the affected STM32 system, control over device unbinding through sysfs, or a hardware fault that prevents PM resume. The primary impact is kernel resource leakage and reduced reliability rather than direct compromise of confidentiality or integrity.

No public exploit code or proof-of-concept is associated with this CVE. The fix is described in the upstream commits referenced by the kernel maintainers, which remove the early return so cleanup completes regardless of the pm_runtime_resume_and_get() result.

Detection Methods for CVE-2026-43004

Indicators of Compromise

Kernel log messages from the spi-stm32-ospi driver indicating pm_runtime_resume_and_get() failures during module unload or device unbind events.
Growing slab allocations associated with SPI controller structures after repeated bind and unbind cycles on STM32 platforms.
Device entries that persist in /sys/class/spi_master/ after a driver removal that reported a PM resume failure.

Detection Strategies

Audit running kernel versions on STM32-based fleet devices and compare against the patched commits 0807532c, 73cd1f97, and b4ec54c9 published by kernel.org.
Monitor dmesg and journal output for spi-stm32-ospi and pm_runtime error patterns during driver lifecycle events.
Use tools such as kmemleak and slabtop on test systems to confirm whether SPI-related allocations grow after stress-testing module load and unload sequences.

Monitoring Recommendations

Forward kernel logs from embedded STM32 deployments to a centralized logging or SIEM platform and alert on PM resume failures tied to SPI drivers.
Track kernel package versions across managed Linux endpoints and flag systems still running pre-patch builds of the affected driver.
Include driver bind and unbind testing in build validation pipelines to catch regressions in resource cleanup paths.

How to Mitigate CVE-2026-43004

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0807532c5ebb72751bfe773e6ae79db0e9c57ab9, 73cd1f97946ae3796544448ff12c07f399bb2881, and b4ec54c974c6ea68b309989dcc3d3511068f45f3.
Update STM32-based Linux distributions and BSPs to a kernel build that incorporates the corrected spi-stm32-ospiremove() callback.
Restrict privileged access required to unbind kernel drivers through sysfs on production STM32 systems until patched kernels are deployed.

Patch Information

The fix removes the early return in the remove() callback so that cleanup of the SPI controller and related resources proceeds even when pm_runtime_resume_and_get() fails. The corrected code paths are documented in three kernel.org references: Kernel Git Commit 0807532c, Kernel Git Commit 73cd1f97, and Kernel Git Commit b4ec54c9. Downstream distributions should pull these fixes into their stable kernel branches.

Workarounds

Avoid unbinding or unloading the spi-stm32-ospi driver on production systems until the patched kernel is installed.
Ensure power supplies, clocks, and regulators feeding the OSPI block remain healthy so that pm_runtime_resume_and_get() does not fail during driver teardown.
Reboot affected STM32 devices after any failed driver removal to release leaked kernel resources until patching is complete.

bash

# Verify the running kernel version and confirm the spi-stm32-ospi module status
uname -r
modinfo spi-stm32-ospi | grep -E '^(filename|version|srcversion)'
dmesg | grep -iE 'stm32-ospi|pm_runtime_resume_and_get'