CVE-2026-43177: Linux Kernel Privilege Escalation Flaw

CVE-2026-43177 Overview

CVE-2026-43177 is a resource management vulnerability in the Linux kernel's Intel IPU6 (Image Processing Unit) media driver. The flaw resides in the ipu6_pci_probe() function, where several error paths jump directly to the out_ipu6_bus_del_devices cleanup label without releasing the runtime power management (RPM) reference. This produces a runtime PM reference leak when probe initialization fails. Maintainers resolved the issue by adding pm_runtime_put_sync() before cleaning up other resources. The fix has been merged into the upstream Linux kernel and stable trees.

Critical Impact
A runtime PM reference leak in the IPU6 probe path can prevent the device from entering low-power states and may interfere with correct driver teardown after initialization failures.

Affected Products

Linux kernel versions containing the Intel IPU6 media driver (drivers/media/pci/intel/ipu6)
Linux distributions shipping the affected kernel revisions prior to the stable backport commits
Systems using Intel IPU6-based imaging hardware (e.g., laptops with Intel Tiger Lake / Alder Lake camera pipelines)

Discovery Timeline

2026-05-06 - CVE-2026-43177 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43177

Vulnerability Analysis

The vulnerability is a resource leak [CWE-772] in the Intel IPU6 PCI driver. During device probe, the kernel acquires a runtime PM reference via the standard pm_runtime_get_* pattern to keep the device powered while probe completes. If a later step in ipu6_pci_probe() fails, the original code transferred control directly to the out_ipu6_bus_del_devices label. That label tore down bus devices and other state but never invoked pm_runtime_put_sync() to release the previously acquired reference.

The consequence is an unbalanced runtime PM refcount on the IPU6 device. Once leaked, the device remains marked as in-use by the PM core, blocking suspend transitions and leaving driver state inconsistent across reload attempts. The fix adds an explicit pm_runtime_put_sync() call before subsequent cleanup so each error path releases what the success path acquired.

Root Cause

The root cause is incorrect error-path unwinding. The probe function used a single shared cleanup label for multiple failure points, but that label did not match the resources held at each failure site. Specifically, the runtime PM reference acquired earlier in probe was not released on these error transitions, violating the acquire/release symmetry required by the Linux PM runtime API.

Attack Vector

This issue is a local reliability and resource-management defect rather than a remotely reachable memory-safety bug. Triggering the leak requires conditions that cause ipu6_pci_probe() to fail at one of the affected steps, such as initialization errors in dependent IPU6 subdevices during driver load. No attacker-controlled input vector has been published, and the upstream commit messages describe the change as a correctness fix. See the Kernel Git Commit Fix for the patch details.

Detection Methods for CVE-2026-43177

Indicators of Compromise

Repeated ipu6 probe failure messages in dmesg or the kernel journal accompanied by the device remaining runtime-PM active
System failure to enter deeper sleep states (S0ix, runtime suspend) on hardware containing an Intel IPU6 imaging unit
Unbalanced runtime PM usage_count for the IPU6 PCI device under /sys/bus/pci/devices/<bdev>/power/runtime_usage

Detection Strategies

Inventory installed kernel versions across Linux endpoints and compare against the stable trees that contain the fix commits referenced by the Kernel Git Commit Update.
Monitor kernel logs for ipu6_pci_probe errors and correlate with subsequent runtime PM state on the same device.
Use configuration management to flag hosts running pre-patch kernels on hardware that loads the intel-ipu6 module.

Monitoring Recommendations

Forward kernel and PM-related log events to a centralized log platform and alert on recurrent IPU6 probe failures.
Track power-management telemetry on mobile fleets to surface devices that fail to reach expected idle residency, which can indicate leaked RPM references.
Re-scan hosts after kernel updates to confirm the patched build is loaded and the IPU6 module reports clean initialization.

How to Mitigate CVE-2026-43177

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that includes the IPU6 probe error-path fix.
Reboot affected systems after patching so the corrected ipu6 module is loaded in place of the vulnerable version.
Validate that runtime PM behavior on IPU6-equipped devices returns to expected idle residency post-update.

Patch Information

The vulnerability is fixed in the mainline Linux kernel and backported to stable trees. The relevant commits are referenced as the Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Improvement, and Kernel Git Commit Change. The fix adds pm_runtime_put_sync() to the failing probe paths so the runtime PM reference is released before other cleanup runs.

Workarounds

If patching is not immediately possible, blacklist the intel-ipu6 module on hosts that do not require camera functionality to avoid triggering the affected probe path.
Avoid repeated module reloads (modprobe/rmmod) of intel-ipu6 on unpatched kernels, since each failed probe can compound the reference leak.

bash

# Configuration example: temporarily prevent the affected driver from loading
echo "blacklist intel-ipu6" | sudo tee /etc/modprobe.d/blacklist-ipu6.conf
sudo update-initramfs -u
# Reboot, then verify the module is not loaded:
lsmod | grep ipu6