CVE-2026-43138: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43138 Overview

CVE-2026-43138 is a Linux kernel vulnerability in the GPIO reset controller subsystem. The flaw allows user-space to trigger a use-after-free condition by unbinding a dynamically created reset device through sysfs bind attributes. The reset-gpio device is created dynamically and intended to remain in memory permanently. No devlink exists between this device and its reset consumer. When user-space unbinds the device, any consumer holding a reset control handle subsequently dereferences freed memory.

Critical Impact
A local user with sysfs write access can trigger a use-after-free splat in the kernel by unbinding the reset-gpio device, leading to memory corruption or denial of service.

Affected Products

Linux kernel (mainline)
Linux kernel stable branches receiving the backported patches
Systems using the reset-gpio driver for GPIO-based reset control

Discovery Timeline

2026-05-06 - CVE-2026-43138 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43138

Vulnerability Analysis

The vulnerability resides in the Linux kernel's GPIO-based reset controller driver (reset-gpio). The driver registers a device dynamically that is expected to live for the lifetime of the system. The kernel exposes default sysfs bind and unbind attributes for driver-bound devices, allowing privileged user-space to detach a driver from a device at runtime.

Because the reset-gpio device has no device link (devlink) to its consumers, unbinding tears down the reset controller while consumers still hold valid handles. Subsequent calls that dereference the freed reset control structure produce a use-after-free condition. This is a kernel memory safety issue [CWE-416].

The EPSS score is 0.018% with a percentile of 4.678, reflecting low observed exploitation probability. Exploitation requires local privileges sufficient to write to sysfs unbind paths, which is typically restricted to root.

Root Cause

The reset-gpio driver did not suppress the default sysfs bind/unbind attributes when registering its dynamically created device. Combined with the absence of a devlink between the reset provider and its consumers, the kernel had no mechanism to prevent or coordinate teardown while consumers retained references to the reset control handle.

Attack Vector

A local attacker with write access to /sys/bus/platform/drivers/reset-gpio/unbind writes the device name to that attribute. The kernel detaches the driver and frees the underlying reset controller structures. Any kernel code path that subsequently calls reset control operations using a previously acquired handle dereferences freed memory and triggers a use-after-free splat reported by KASAN. Depending on heap state, this can lead to denial of service or further memory corruption.

No verified exploit code is publicly available. The vulnerability mechanism is described in the upstream patch commit messages referenced by the kernel maintainers. See the Kernel Patch 09d6efc for the implementation fix.

Detection Methods for CVE-2026-43138

Indicators of Compromise

Kernel log entries containing KASAN: use-after-free referencing reset control functions
Unexpected unbind write events targeting /sys/bus/platform/drivers/reset-gpio/
Kernel oops or panic traces involving reset_control_* symbols after device unbind operations

Detection Strategies

Audit kernel ring buffer (dmesg) for KASAN reports and call traces involving reset-gpio symbols
Monitor sysfs write activity to platform driver bind and unbind attributes using auditd rules
Correlate unprivileged-to-root escalations with subsequent sysfs unbind operations on kernel devices

Monitoring Recommendations

Enable kernel auditing for writes to /sys/bus/*/drivers/*/unbind paths
Forward kernel logs to a centralized log analytics platform for anomaly correlation
Track running kernel versions across the fleet to identify hosts missing the upstream fix

How to Mitigate CVE-2026-43138

Immediate Actions Required

Apply the upstream kernel patches that suppress sysfs bind attributes for the reset-gpio device
Update to a stable kernel release that includes the fix for your distribution
Restrict root and CAP_SYS_ADMIN access on systems using GPIO-based reset controllers

Patch Information

The fix marks the reset-gpio platform driver to suppress sysfs bind attributes, preventing user-space from unbinding the device. Distribution kernels should pull the relevant stable backports. Reference commits: Kernel Patch 09d6efc, Kernel Patch 16de4c6, Kernel Patch 1d7d869, and Kernel Patch 76801c3.

Workarounds

Restrict permissions on /sys/bus/platform/drivers/reset-gpio/unbind to prevent non-root writes
Use mandatory access control policies such as SELinux or AppArmor to deny writes to driver unbind attributes
Where feasible, build kernels without the reset-gpio driver if not required by the platform

bash

# Configuration example: restrict access to reset-gpio unbind via udev
# /etc/udev/rules.d/99-reset-gpio.rules
SUBSYSTEM=="platform", DRIVER=="reset-gpio", \
    RUN+="/bin/chmod 0000 /sys/bus/platform/drivers/reset-gpio/unbind"