CVE-2026-43155: Linux Kernel MMIO Regmap Leak Vulnerability

CVE-2026-43155 Overview

CVE-2026-43155 is a memory leak vulnerability in the Linux kernel's mux subsystem, specifically in the mux-mmio driver. The mmio regmap allocated during driver probe is never freed on failure paths, leading to leaked kernel memory. The fix switches the allocation to use the device managed allocator (devm_*) so the regmap is released on probe failures such as probe deferral and on driver unbind.

Critical Impact
Repeated probe failures or driver unbind cycles cause unbounded kernel memory consumption, which may degrade system stability over time on affected Linux systems using the mux mmio driver.

Affected Products

Linux kernel versions containing the mux-mmio driver prior to the fix
Stable kernel branches addressed by commits 3c4ae630, 76096f15, and cbde3c10
Systems using mux framework drivers backed by mmio regmaps

Discovery Timeline

2026-05-06 - CVE-2026-43155 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43155

Vulnerability Analysis

The vulnerability resides in the mux multiplexer subsystem of the Linux kernel, specifically the mmio backend. During driver probe, the code allocates an mmio-backed regmap to manage memory-mapped register access for the multiplexer device. The allocation lifecycle was not tied to the device, so any error path after allocation leaked the regmap.

Probe deferral is a common pattern in the Linux driver model. When a dependent resource is not yet available, the kernel calls probe again later. Each deferred probe iteration that succeeded in allocating the regmap, then failed afterward, leaked one regmap object. Driver unbind triggered the same leak because there was no explicit free in the remove path.

This class of issue is categorized as a Memory Leak [CWE-401]. While not directly exploitable for code execution, sustained leakage reduces available kernel memory and can contribute to denial-of-service conditions on long-running systems.

Root Cause

The root cause is manual memory management of a kernel object whose lifetime should match the underlying struct device. The driver used a non-managed allocation API for the regmap and lacked corresponding cleanup in error and unbind paths. The fix replaces the allocation with the device managed allocator, ensuring automatic release whenever the device is detached or probe fails.

Attack Vector

Local triggering requires the ability to cause repeated probe attempts or driver bind/unbind cycles on a system where the mux-mmio driver is in use. This typically requires elevated privileges or physical control over hardware events. The vulnerability does not provide remote attack surface and does not yield code execution or privilege escalation by itself.

The vulnerability is described in the upstream commits. See Kernel Git Commit 3c4ae63, Kernel Git Commit 76096f15, and Kernel Git Commit cbde3c10 for the patch details.

Detection Methods for CVE-2026-43155

Indicators of Compromise

Gradual increase in kernel slab memory attributable to regmap allocations on systems using the mux-mmio driver
Repeated probe deferral messages for mux-mmio in dmesg or the kernel log
Bind/unbind cycles of mux-mmio in sysfs visible through audit logs

Detection Strategies

Compare running kernel versions against the patched stable branches referenced by commits 3c4ae63, 76096f15, and cbde3c10
Monitor /proc/slabinfo and kmemleak reports for unbounded growth in regmap-related caches
Inventory systems where the mux-mmio driver is loaded using lsmod and module dependency data

Monitoring Recommendations

Enable CONFIG_DEBUG_KMEMLEAK on test systems to capture leak reports tied to the mux-mmio probe path
Track kernel memory utilization trends across long-running hosts and alert on sustained growth without workload change
Forward kernel logs to a central log platform and alert on repeated probe deferral events for mux-mmio

How to Mitigate CVE-2026-43155

Immediate Actions Required

Identify hosts running unpatched Linux kernels that include the mux-mmio driver
Apply the upstream fix or update to a stable kernel release that includes commits 3c4ae63, 76096f15, or cbde3c10
Restrict access to driver bind/unbind sysfs interfaces to privileged users only

Patch Information

The fix is delivered through three stable kernel commits that switch the mmio regmap to the device managed allocator. Review Kernel Git Commit 3c4ae63, Kernel Git Commit 76096f15, and Kernel Git Commit cbde3c10 and apply the version corresponding to the affected stable branch in use.

Workarounds

Avoid scripted or repeated bind/unbind operations against the mux-mmio driver until patches are applied
Reboot affected hosts periodically to reclaim leaked kernel memory if patching must be deferred
Where feasible, unload the mux-mmio driver on systems that do not require it

bash

# Verify whether the mux-mmio driver is in use and check kernel version
uname -r
lsmod | grep -i mux_mmio
dmesg | grep -i 'mux-mmio'