CVE-2026-43008: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43008 Overview

CVE-2026-43008 is a Linux kernel vulnerability in the gpio: qixis-fpga driver. The driver checked the return value of devm_regmap_init_mmio() against NULL, but this function returns an ERR_PTR() on failure rather than NULL. The faulty check would never trigger on error, allowing execution to continue with an invalid pointer. Subsequent dereferences of that pointer can lead to a kernel crash or memory corruption.

The upstream fix replaces the NULL check with IS_ERR() and returns PTR_ERR() to propagate the error correctly.

Critical Impact
Improper error handling in the qixis-fpga GPIO driver can result in an invalid pointer dereference in kernel context, leading to a kernel oops or denial of service on affected NXP/Freescale Layerscape platforms.

Affected Products

Linux kernel versions containing the gpio-qixis-fpga driver prior to the fix
Stable kernel branches addressed by commits 8de4e0f44c63 and e54b8fe9454c
Linux distributions shipping the unpatched qixis-fpga GPIO driver

Discovery Timeline

2026-05-01 - CVE-2026-43008 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43008

Vulnerability Analysis

The vulnerability resides in the gpio-qixis-fpga driver, which provides GPIO control via an FPGA-backed memory-mapped register interface on NXP Layerscape QIXIS platforms. During driver probe, the code calls devm_regmap_init_mmio() to allocate a regmap structure backed by an MMIO region. The original code tested the returned pointer against NULL.

The devm_regmap_init_mmio() API does not return NULL on failure. It returns an encoded error pointer via the ERR_PTR() macro. Testing only for NULL allows an error-encoded pointer to pass validation. The driver then proceeds to use this pointer as if it were a valid regmap handle.

When the kernel later dereferences the encoded error value, the access lands in a non-canonical or unmapped address range. This produces a kernel oops and likely panics the affected CPU path, resulting in denial of service [CWE-690, CWE-476].

Root Cause

The root cause is a misuse of the kernel error-pointer convention. Functions returning ERR_PTR()-encoded values must be validated using IS_ERR(), with the error code extracted using PTR_ERR(). The original probe routine used if (!ptr) semantics, which never matches an ERR_PTR(). The fix introduces IS_ERR() and PTR_ERR() to correctly detect and propagate failure from devm_regmap_init_mmio().

Attack Vector

The vulnerability is triggered along the driver probe path. Reaching the faulty branch requires devm_regmap_init_mmio() to fail, which generally occurs under resource exhaustion, malformed device tree data, or constrained MMIO mapping conditions. Exploitation requires local access to a system using the qixis-fpga GPIO controller and is bounded to a denial-of-service outcome rather than privilege escalation or code execution.

No verified public proof-of-concept code is available. See the upstream commits referenced in the Kernel Git Change Log for the exact code change.

Detection Methods for CVE-2026-43008

Indicators of Compromise

Unexpected kernel oops or panic messages referencing gpio-qixis-fpga or regmap during driver probe in dmesg or /var/log/kern.log.
System boot failures or device unavailability on NXP Layerscape platforms using the QIXIS FPGA GPIO controller.
Repeated probe failures logged for the qixis-fpga module across reboots.

Detection Strategies

Inventory running kernel versions and confirm whether they include commits 8de4e0f44c63 or e54b8fe9454c.
Audit kernel crash dumps for faulting addresses in the ERR_PTR() numeric range (small negative values cast to pointers) referenced from regmap call sites.
Compare installed kernel package versions against vendor advisories for the affected stable branches.

Monitoring Recommendations

Forward dmesg and kern.log to a centralized logging pipeline and alert on kernel oops events naming the qixis-fpga driver.
Monitor device probe success on Layerscape hardware and flag repeated GPIO controller initialization failures.
Track patch deployment status for kernel updates across all Linux fleets that include embedded or networking platforms using the QIXIS FPGA.

How to Mitigate CVE-2026-43008

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 8de4e0f44c63 and e54b8fe9454c from the stable tree.
Update to a distribution kernel package that incorporates the qixis-fpga error-handling fix.
Restrict local access on systems where the unpatched driver is loaded until patching is complete.

Patch Information

The fix replaces the NULL check on the return value of devm_regmap_init_mmio() with IS_ERR() and propagates the error using PTR_ERR(). Patches are available in the Kernel Git Change Log (8de4e0f4) and the Kernel Git Change Log (e54b8fe9).

Workarounds

Blacklist the gpio-qixis-fpga module on systems that do not require QIXIS FPGA GPIO functionality until the kernel is patched.
Validate device tree entries to reduce the probability of devm_regmap_init_mmio() failure on affected platforms.

bash

# Blacklist the qixis-fpga driver until the kernel is patched
echo 'blacklist gpio-qixis-fpga' | sudo tee /etc/modprobe.d/blacklist-qixis-fpga.conf
sudo update-initramfs -u

# Verify the running kernel includes the fix commits
uname -r
zcat /proc/config.gz 2>/dev/null | grep -i QIXIS