CVE-2026-43122: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43122 Overview

CVE-2026-43122 is a NULL pointer dereference vulnerability in the Linux kernel's Advanced Configuration and Power Interface (ACPI) processor subsystem. The flaw resides in the __acpi_processor_start() function, where an outdated cpuidle driver check can trigger a NULL dereference inside __cpuidle_register_device(). The issue was introduced by commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration"), which relocated idle driver registration to acpi_processor_driver_init() but left a stale check in place. The bug has been resolved upstream in the stable Linux kernel tree.

Critical Impact
A NULL pointer dereference in kernel code paths invoked during processor initialization can lead to a kernel panic and denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing commit 7a8c994cbb2d prior to the fix
Linux distributions shipping vulnerable mainline and stable kernel branches
Systems using the ACPI processor driver for cpuidle management

Discovery Timeline

2026-05-06 - CVE-2026-43122 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43122

Vulnerability Analysis

The vulnerability stems from inconsistent state handling between two functions in the Linux kernel ACPI processor driver. Commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") moved the ACPI idle driver registration from acpi_processor_power_init() to acpi_processor_driver_init(). After this change, acpi_processor_power_init() no longer registers an idle driver.

The cpuidle driver check in __acpi_processor_start() was not updated to reflect this architectural change. As a result, __acpi_processor_start() may invoke acpi_processor_power_init() when no cpuidle driver has been registered. The function then attempts to register a cpuidle device through __cpuidle_register_device(), which dereferences a NULL driver pointer. The dereference triggers a kernel oops and aborts processor bring-up.

Root Cause

The root cause is a logic inconsistency introduced during a refactor. The driver registration code path was relocated, but the corresponding precondition check in __acpi_processor_start() remained tied to the old assumption that an idle driver would be registered by acpi_processor_power_init(). This is a classic NULL pointer dereference [CWE-476] caused by missing validation of driver state before device registration.

Attack Vector

The vulnerability is triggered during ACPI processor initialization, which executes during kernel boot or processor hotplug events. Exploitation does not appear to be remotely reachable. A local attacker or malicious operator capable of triggering processor hotplug or loading the affected kernel could induce a kernel panic, resulting in denial of service. There is no indication of memory corruption, code execution, or privilege escalation potential beyond the DoS condition.

The upstream fix updates the cpuidle driver check in __acpi_processor_start() so that acpi_processor_power_init() is not invoked when no cpuidle driver is registered. See the Linux Kernel Commit Log, Linux Kernel Commit Changes, and Linux Kernel Commit Update for the patch details.

Detection Methods for CVE-2026-43122

Indicators of Compromise

Kernel oops or panic messages referencing __cpuidle_register_device in dmesg or /var/log/kern.log
Stack traces containing __acpi_processor_start and acpi_processor_power_init during boot
Unexpected processor bring-up failures or missing CPUs after kernel update

Detection Strategies

Inventory running kernel versions across the Linux estate and compare against fixed stable releases referenced in the upstream commits.
Parse kernel logs for NULL pointer dereference signatures originating from the ACPI processor driver path.
Correlate boot-time crash dumps with commit 7a8c994cbb2d presence in the deployed kernel source tree.

Monitoring Recommendations

Forward journald and kmsg output to a centralized log platform and alert on kernel oops events.
Track host availability and reboot loops on Linux servers, which can indicate repeated panics during ACPI initialization.
Monitor configuration management for kernel package versions that lag behind vendor security updates.

How to Mitigate CVE-2026-43122

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as distribution updates are available.
Identify hosts running kernels that include commit 7a8c994cbb2d but not the fix and prioritize them for patching.
Validate kernel updates in a staging environment to confirm processor initialization completes without oops messages.

Patch Information

The vulnerability is resolved by three stable tree commits: 0089ce1c056aee547115bdc25c223f8f88c08498, 68f38f648e4b5bed2aeadd2f711e25302e6490f8, and 6cfed39c2ce64ac024bbde458a9727105e0b8c66. The fix updates the cpuidle driver check in __acpi_processor_start() so the function does not call acpi_processor_power_init() when no cpuidle driver is registered. Distribution maintainers will backport these changes to supported stable kernel branches.

Workarounds

No official workaround has been published. Apply the kernel patch when available.
For systems where rebuilding the kernel is feasible, cherry-pick the upstream fix commits into the local kernel tree.
Restrict physical and administrative access to limit the ability of local actors to trigger processor hotplug events.

bash

# Verify the running kernel version and check for the fix
uname -r
rpm -q kernel    # RHEL/CentOS/Fedora
dpkg -l | grep linux-image    # Debian/Ubuntu

# Inspect kernel logs for ACPI processor errors
dmesg | grep -i -E 'acpi_processor|cpuidle_register'
journalctl -k -p err --since '1 hour ago'