CVE-2026-43145 Overview
CVE-2026-43145 is a Linux kernel vulnerability in the imx_rproc remoteproc driver for NXP i.MX SoCs. The function imx_rproc_elf_find_loaded_rsc_table() incorrectly reports a loaded resource table when the current firmware does not provide one. When the device tree contains an rsc-table entry, priv->rsc_table is non-NULL even if rproc->table_ptr is NULL. The remoteproc core then interprets the returned pointer as a valid loaded resource table. Starting firmware without a resource table triggers a kernel crash, resulting in denial of service on affected i.MX-based systems.
Critical Impact
Loading remote-processor firmware that lacks a resource table on platforms with an rsc-table device tree entry causes a kernel crash and denial of service.
Affected Products
- Linux kernel (mainline) with the imx_rproc remoteproc driver enabled
- NXP i.MX SoC platforms using device trees containing an rsc-table entry
- Stable kernel branches addressed by the seven referenced commits on git.kernel.org
Discovery Timeline
- 2026-05-06 - CVE-2026-43145 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43145
Vulnerability Analysis
The defect resides in the i.MX remoteproc driver in drivers/remoteproc/imx_rproc.c. The function imx_rproc_elf_find_loaded_rsc_table() is called by the remoteproc core to locate a firmware-provided resource table after ELF loading. The driver returns priv->rsc_table, a memory region derived from the device tree rsc-table property, regardless of whether the loaded firmware actually defines a resource table.
When firmware contains no resource table, rproc->table_ptr is NULL, signaling the absence of a valid table. The driver still hands back the device-tree-backed pointer. The remoteproc core treats this stale, uninitialized memory region as a live resource table and proceeds to parse it, which leads to a kernel crash. This is a Null Pointer Dereference / Kernel Vulnerability class issue [CWE-476-adjacent].
Root Cause
The root cause is inconsistent semantics between the driver helper and the remoteproc core. imx_rproc_elf_find_loaded_rsc_table() returns a non-NULL pointer based on device tree configuration alone, while the core expects a non-NULL return only when a valid loaded resource table exists. The function does not validate rproc->table_ptr before returning priv->rsc_table.
Attack Vector
Exploitation requires the ability to load remote-processor firmware on a vulnerable i.MX system. A local user with privileges to invoke firmware loading, or a malformed firmware image deployed during boot, can trigger the crash by loading firmware that omits the resource table section. Remote exploitation is not described in the upstream patch notes.
The fix returns NULL from imx_rproc_elf_find_loaded_rsc_table() when rproc->table_ptr is NULL, aligning the helper with core expectations. See the upstream commits, including Linux Kernel Commit fcec79b and Linux Kernel Commit 500778d, for technical details.
Detection Methods for CVE-2026-43145
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing imx_rproc, remoteproc, or rproc_start in dmesg or serial console logs
- Repeated remoteproc start failures correlated with firmware updates on i.MX devices
- System reboots or watchdog resets immediately following remote-processor firmware load operations
Detection Strategies
- Audit running kernel versions against the patched stable releases referenced by the seven upstream commits
- Inspect device trees for an rsc-table reservation entry combined with firmware that omits the .resource_table ELF section
- Monitor kernel ring buffer and journald for crashes during rproc_boot() or rproc_start() call paths
Monitoring Recommendations
- Centralize kernel logs from i.MX-based fleets and alert on imx_rproc error strings or kernel panics
- Track firmware deployment pipelines and correlate firmware version changes with device crash telemetry
- Validate firmware ELF images for the presence of a .resource_table section before deployment
How to Mitigate CVE-2026-43145
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry to all affected i.MX systems
- Inventory devices using CONFIG_REMOTEPROC_IMX and identify those with rsc-table device tree nodes
- Restrict firmware-loading capabilities to administrative accounts and signed firmware images
Patch Information
The vulnerability is fixed across multiple stable branches by the following commits: 198c629, 26aa529, 500778d, 65379ad, 91baf24, 9bd98d0, and fcec79b. The patch modifies imx_rproc_elf_find_loaded_rsc_table() to return NULL when rproc->table_ptr is NULL.
Workarounds
- Avoid loading firmware images that lack a .resource_table ELF section on i.MX platforms with an rsc-table device tree entry
- Remove the rsc-table device tree node on platforms where remoteproc firmware never publishes a resource table
- Disable the imx_rproc driver via kernel configuration on systems that do not require remote-processor support
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
