CVE-2026-43196: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43196 Overview

CVE-2026-43196 is a double free vulnerability in the Linux kernel's Texas Instruments Programmable Real-Time Unit Subsystem (PRUSS) driver located at soc/ti/pruss. The flaw resides in the pruss_clk_mux_setup() function, where a device tree node reference is released twice on the error path. The kernel maintainers resolved the issue by returning directly after devm_add_action_or_reset() to avoid the duplicate of_node_put() call. Multiple stable kernel branches received corresponding patches.

Critical Impact
A double free of the clk_mux_np device tree node can corrupt kernel reference counting structures and lead to memory corruption or denial of service on affected TI SoC platforms.

Affected Products

Linux kernel branches containing the soc: ti: pruss clock mux setup logic
Texas Instruments SoC platforms using the PRUSS subsystem driver
Distributions shipping kernels prior to the backported fixes referenced in the stable tree

Discovery Timeline

2026-05-06 - CVE-2026-43196 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43196

Vulnerability Analysis

The vulnerability resides in pruss_clk_mux_setup() within the Linux kernel's TI PRUSS driver. The function calls devm_add_action_or_reset() to register a managed cleanup action that indirectly invokes pruss_of_free_clk_provider(). That cleanup callback executes of_node_put(clk_mux_np) on the error path. After the managed action registration returns, the original code path also calls of_node_put(clk_mux_np) on the same node, decrementing the reference count twice for a single acquisition.

The upstream fix changes the control flow to return directly when devm_add_action_or_reset() handles the resource, eliminating the second of_node_put() call. This pattern is a recurring class of defect in kernel code that mixes manual reference management with devm_* managed cleanup helpers.

Root Cause

The root cause is a Double Free [CWE-415] of an of_node reference. devm_add_action_or_reset() guarantees execution of the registered cleanup action even when registration itself fails, so callers must not perform the same cleanup manually afterward. The pre-patch implementation violated this contract by issuing a redundant of_node_put() on clk_mux_np.

Attack Vector

Triggering the defect requires the pruss_clk_mux_setup() error path to execute. This typically occurs during driver probe with a malformed or resource-constrained device tree configuration on TI SoC hardware. The attack surface is local and dependent on platform configuration. There are no public reports of remote exploitation, and the vulnerability primarily presents as a kernel stability and memory safety issue rather than a remote attack vector.

The vulnerability is described in the kernel commits referenced by the stable tree, including Kernel Commit 04dbbb1 and Kernel Commit 24c4007. No verified exploitation code is available for this issue.

Detection Methods for CVE-2026-43196

Indicators of Compromise

Kernel panics, oops messages, or refcount_t warnings referencing of_node_put during PRUSS driver probe
KASAN: use-after-free or slab-use-after-free reports tied to device tree node objects on TI platforms
Repeated PRUSS driver probe failures accompanied by reference count underflow warnings in dmesg

Detection Strategies

Audit kernel build versions on TI SoC fleets and compare against the patched commits in the stable tree references
Enable CONFIG_DEBUG_KOBJECT_RELEASE and KASAN in test environments to surface double free conditions during PRUSS initialization
Review boot logs for PRUSS clock mux setup failures and correlate with device tree changes

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log platform and alert on refcount_t, KASAN, and BUG: strings
Track kernel package versions across embedded TI deployments using configuration management tooling
Monitor uptime regressions on PRUSS-enabled devices that may indicate panic-and-reboot loops

How to Mitigate CVE-2026-43196

Immediate Actions Required

Identify all systems running Linux kernels with the TI PRUSS driver enabled (CONFIG_TI_PRUSS)
Apply the upstream patches referenced in the stable kernel tree commits and rebuild affected kernels
Coordinate with hardware vendors and distribution maintainers for backported updates on long-term support branches

Patch Information

The fix is available across multiple stable kernel branches. Reference commits include Kernel Commit 04dbbb1, Kernel Commit 24c4007, Kernel Commit 69aa67c, Kernel Commit 80db65d, Kernel Commit 818cf66, Kernel Commit b7db995, Kernel Commit dbda01b, and Kernel Commit e113339. The fix returns directly after devm_add_action_or_reset() to remove the duplicate of_node_put(clk_mux_np).

Workarounds

Disable the PRUSS driver in kernel configuration (CONFIG_TI_PRUSS=n) on systems that do not require PRUSS functionality
Avoid loading device tree overlays that exercise the pruss_clk_mux_setup() error path until patched kernels are deployed
Restrict physical and administrative access to affected TI SoC devices to reduce the local attack surface

bash

# Verify whether the PRUSS module is present and loaded
zgrep -i CONFIG_TI_PRUSS /proc/config.gz /boot/config-$(uname -r) 2>/dev/null
lsmod | grep -i pruss

# Check the running kernel version against patched stable releases
uname -r