CVE-2026-43007 Overview
CVE-2026-43007 is a Linux kernel vulnerability in the accel/qaic driver that handles Qualcomm Cloud AI accelerator devices. The flaw involves improper handling of Doorbell Channel (DBC) deactivation transactions when the owning user process exits before the device finishes its deactivation handshake. When a user goes away before processing a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction, the host state desynchronizes from the device, leaving DBC resources allocated until the device is removed. A subsequent process attempting to activate a network on the same DBC will hang indefinitely while waiting for dbc->in_use = false.
Critical Impact
Subsequent user processes can hang indefinitely on dbc->in_use, denying access to the AI accelerator until the device is removed and reinitialized.
Affected Products
- Linux kernel branches containing the accel/qaic driver prior to the upstream fix
- Systems using Qualcomm Cloud AI 100 (QAIC) accelerators via the kernel accel subsystem
- Distributions shipping affected stable kernels referenced in the upstream commits
Discovery Timeline
- 2026-05-01 - CVE-2026-43007 published to NVD
- 2026-05-01 - Last updated in NVD database
Technical Details for CVE-2026-43007
Vulnerability Analysis
The accel/qaic driver manages communication with Qualcomm AI accelerators through Doorbell Channels (DBCs) over the QAIC_CONTROL MHI channel. When a DBC is released, the device emits a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction so the host can free the corresponding resources. The driver processes this transaction inside the qaic_manage_ioctl() context, which is bound to the lifetime of the user process holding the DBC.
If the owning process exits before the deactivation transaction is received and handled, the driver never executes decode_deactivate() for that DBC. The DBC remains marked as in use in host state while the device considers it free. When another user later requests network activation, the device may reassign the same DBC. The driver then waits on dbc->in_use to become false, a condition that no longer occurs because the previous owner is gone, producing an indefinite hang in the new user process.
The upstream fix extends handling so that QAIC_TRANS_DEACTIVATE_FROM_DEV transactions received after the user has gone away are still decoded and the resources released. This is a logic and lifecycle defect rather than a memory-corruption bug, but it produces a denial-of-service condition for the accelerator.
Root Cause
The root cause is a lifecycle mismatch between user-context ioctl handling and asynchronous device-originated transactions. Deactivation handling depends on the user remaining alive long enough to process the device message, with no fallback path when the owner exits early.
Attack Vector
A local user with access to the QAIC device node can trigger the condition by activating a network and exiting before the device-originated deactivation completes. The defect is reachable only by users authorized to interact with the accelerator and does not yield code execution or privilege escalation. The practical impact is denial of service against the AI accelerator for other tenants on the same host. See the upstream patches in the Linux stable tree for the full code-level fix: Kernel commit f403094d.
Detection Methods for CVE-2026-43007
Indicators of Compromise
- User-space processes blocked in uninterruptible sleep inside qaic_manage_ioctl() waiting on dbc->in_use
- Repeated failures to activate networks on a QAIC device after a prior user crashed or was killed
- Recovery of accelerator availability only after unloading the qaic module or removing and re-probing the device
Detection Strategies
- Inspect /proc/<pid>/stack for QAIC tasks stuck in DBC activation paths to identify hung processes
- Correlate kernel logs from the accel/qaic subsystem with abrupt termination of prior QAIC client processes
- Track the running kernel version against the patched stable releases referenced in the upstream commits
Monitoring Recommendations
- Alert on processes accessing the QAIC device node that remain in D state beyond expected activation timeouts
- Monitor unexpected unloads or rebinds of the qaic driver, which often indicate manual recovery from this condition
- Forward kernel ring buffer messages from QAIC-equipped hosts to centralized logging for trend analysis
How to Mitigate CVE-2026-43007
Immediate Actions Required
- Update affected hosts to a Linux stable release containing the upstream fix referenced in the kernel git commits
- Restrict access to the QAIC device node to trusted workloads using standard Linux file permissions and namespaces
- Identify and terminate any user processes already hung on dbc->in_use and reload the qaic driver to restore service
Patch Information
The fix is delivered through multiple Linux stable backports. Refer to the relevant commits: Kernel commit 08021f2d, Kernel commit 2dd67966, Kernel commit 2feec5ae, Kernel commit ee0180e7, and Kernel commit f403094d. The patch teaches the driver to handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that arrive after the owning user has exited.
Workarounds
- Avoid abrupt termination of QAIC client processes; allow controlled shutdown so deactivation transactions complete in qaic_manage_ioctl() context
- When a hang occurs, unload and reload the qaic kernel module or remove and re-probe the PCI device to free DBC resources
- Limit QAIC device access to a single trusted workload at a time on unpatched kernels to reduce contention for shared DBCs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
