CVE-2026-43108 Overview
CVE-2026-43108 is a Linux kernel vulnerability in the Qualcomm protection domain (PD) mapper subsystem. The flaw resides in the soc/qcom/pd-mapper driver, specifically in the servreg_loc_pfr_req_ei element information structure. The declared element length for the reason field does not match the corresponding reason field length in servreg_loc_pfr_req. This mismatch produces a Qualcomm Messaging Interface (QMI) decoding error when a protection domain crashes, surfaced as qmi_decode_string_elem: String len 81 >= Max Len 65. The issue has been resolved upstream in the Linux kernel.
Critical Impact
A QMI string decoding error during PD crash handling on Qualcomm SoC platforms can disrupt protection domain restart and service registration recovery.
Affected Products
- Linux kernel soc/qcom/pd-mapper driver on Qualcomm SoC platforms
- Kernel branches prior to the fixes in commits 641f6fd, 7d75145, c93ca7c, and cba8413
- Distributions and downstream kernels carrying the unpatched servreg_loc_pfr_req_ei definition
Discovery Timeline
- 2026-05-06 - CVE-2026-43108 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43108
Vulnerability Analysis
The Linux kernel pd-mapper driver implements service registry communication for Qualcomm protection domains using QMI. QMI structures are described by element information (_ei) tables that drive the encode and decode logic. The structure servreg_loc_pfr_req defines a reason string field with a specific maximum length. The corresponding servreg_loc_pfr_req_ei table declared an element length that did not match the structure field length.
When a protection domain crashes, the remote subsystem sends a QMI message whose reason field can exceed the mismatched maximum length advertised by the element table. The decoder rejects the message with qmi_decode_string_elem: String len 81 >= Max Len 65. As a result, the kernel cannot properly process the PD failure-reason notification.
Root Cause
The root cause is an inconsistency between the data structure definition and its QMI element information descriptor. Element length metadata in servreg_loc_pfr_req_ei did not reflect the actual reason field size in servreg_loc_pfr_req. The fix aligns the element length in the descriptor with the structure definition, allowing the QMI decoder to accept the inbound string without truncation or rejection.
Attack Vector
This is a kernel correctness defect rather than a remotely exploitable flaw. The attack vector is unknown and no exploit is publicly available. Triggering the decoding error requires a protection domain crash event on a Qualcomm SoC system, which is generated by the platform firmware rather than user-controlled input. Refer to the upstream patches for technical details: Kernel Git Commit 641f6fd, Kernel Git Commit 7d75145, Kernel Git Commit c93ca7c, and Kernel Git Commit cba8413.
Detection Methods for CVE-2026-43108
Indicators of Compromise
- Kernel log entries containing qmi_decode_string_elem: String len 81 >= Max Len 65 from the pd-mapper driver.
- Repeated protection domain crash notifications on Qualcomm SoC devices that fail to decode cleanly.
- Service registry restart failures following a remote subsystem (modem, ADSP, SLPI) crash.
Detection Strategies
- Audit running kernel versions across Qualcomm-based Linux fleets and compare against the fixed commits referenced above.
- Inspect dmesg and persistent kernel ring buffers for the QMI decode error string associated with PD crashes.
- Correlate pd-mapper decode failures with subsystem restart (SSR) events to identify affected platforms.
Monitoring Recommendations
- Forward kernel logs from Qualcomm SoC devices to a centralized logging or SIEM platform for pattern matching on QMI decode errors.
- Alert on recurring protection domain crash notifications that fail QMI decoding to flag impacted hosts.
- Track kernel package versions through configuration management to confirm patch deployment status.
How to Mitigate CVE-2026-43108
Immediate Actions Required
- Apply the upstream Linux kernel patches that correct the element length in servreg_loc_pfr_req_ei to match servreg_loc_pfr_req.
- Update to a vendor-supplied kernel build that incorporates commits 641f6fda143b, 7d75145672cf, c93ca7c5a72e, or cba84132c2ac for the relevant stable branch.
- Validate the fix by reproducing a protection domain crash scenario and confirming clean QMI decoding in kernel logs.
Patch Information
The vulnerability is resolved by aligning the QMI element length in servreg_loc_pfr_req_ei with the reason field of servreg_loc_pfr_req. Stable-tree fixes are available in Kernel Git Commit 641f6fd, Kernel Git Commit 7d75145, Kernel Git Commit c93ca7c, and Kernel Git Commit cba8413. Distribution-specific kernel updates should be obtained from the relevant vendor channel.
Workarounds
- No supported workaround exists; the defect lives in the QMI element descriptor and requires a kernel-level fix.
- On unpatched systems, expect occasional loss of PD crash-reason fidelity until the kernel is updated.
- Where feasible, disable or unload the pd-mapper module only in test environments, as production Qualcomm platforms rely on it for subsystem service registration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
