CVE-2026-43200: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43200 Overview

CVE-2026-43200 is a Linux kernel vulnerability in the PCI endpoint subsystem. The flaw resides in the pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() functions, which pass parameters to configfs_item_operations callbacks in the wrong order. The allow_link and drop_link callback prototypes expect (struct config_item *src, struct config_item *target), but the unlink helpers swap these arguments. Triggering the unlink command through configfs causes a kernel paging fault and a crash in the pci_epf_unbind() path.

Critical Impact
A local user with access to the PCI endpoint configfs interface can crash the kernel by issuing an unlink operation, resulting in denial of service.

Affected Products

Linux kernel versions implementing the PCI endpoint framework with pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() callbacks
Stable kernel branches receiving the backported fixes referenced by the seven upstream commits
Systems exposing the PCI endpoint configfs interface (/sys/kernel/config/pci_ep/)

Discovery Timeline

2026-05-06 - CVE-2026-43200 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43200

Vulnerability Analysis

The Linux PCI endpoint framework exposes configfs hooks that allow userspace to bind and unbind endpoint functions (EPFs) to endpoint controllers (EPCs). The configfs subsystem defines symmetric callbacks for symbolic links: allow_link(src, target) and drop_link(src, target).

The link helpers pci_primary_epc_epf_link() and pci_secondary_epc_epf_link() pass src and target correctly. The corresponding unlink helpers pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() reverse the arguments. When userspace removes a symbolic link in configfs, the kernel dereferences the wrong config_item, treating arbitrary data as a valid pointer.

The resulting fault chain proceeds through pci_epf_unbind() into vsnprintf() and string(), where dereferencing the malformed pointer triggers a paging request to an invalid virtual address such as 0000000300000857. The kernel oops terminates the calling task and may destabilize the system.

Root Cause

The root cause is a parameter ordering mismatch between the configfs callback prototype and the implementation in the PCI endpoint driver. The unlink functions interpret the targetconfig_item as the src and vice versa, breaking pointer arithmetic used to retrieve the parent EPF or EPC structure.

Attack Vector

The attack vector requires local access to the configfs mount and permissions to manipulate PCI endpoint links. An unprivileged or privileged user issues an unlink syscall (for example via rm) against an established primary_epc or secondary_epc symlink. The crash occurs synchronously in __arm64_sys_unlinkat → vfs_unlink → configfs_unlink → pci_epf_unbind. No network exposure is involved.

The vulnerability has no associated exploit code and is described in prose only. Refer to the upstream commits listed under Kernel Git Commit Patch 1 and Kernel Git Commit Patch 7 for the exact diff.

Detection Methods for CVE-2026-43200

Indicators of Compromise

Kernel oops messages referencing pci_epf_unbind+0xdc/0x108 followed by configfs_unlink in the call trace
Paging request faults at unusual virtual addresses such as 0000000300000857 originating from vsnprintf or string
Unexpected reboots or task terminations on systems exposing /sys/kernel/config/pci_ep/

Detection Strategies

Monitor dmesg and /var/log/kern.log for Unable to handle kernel paging request entries that include pci_epf_unbind in the stack trace.
Audit usage of the unlinkat syscall against paths under the PCI endpoint configfs hierarchy using auditd rules.
Inventory kernel versions across Linux fleets and flag hosts running unpatched stable branches that include the PCI endpoint framework.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline and alert on repeated oops events.
Track configfs filesystem operations on hosts that act as PCI endpoint controllers, especially embedded or testing systems.
Correlate kernel crash dumps with running workloads to identify whether the unlink path was reached intentionally or by misconfiguration.

How to Mitigate CVE-2026-43200

Immediate Actions Required

Apply the upstream Linux kernel patches that correct the parameter order in pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink().
Restrict access to /sys/kernel/config/pci_ep/ to trusted administrators using filesystem permissions and mount options.
Disable the PCI endpoint framework on systems that do not require endpoint mode by removing or blacklisting the relevant kernel modules.

Patch Information

The fix is distributed across seven upstream commits in the stable kernel tree. Reference Kernel Git Commit Patch 1, Kernel Git Commit Patch 2, Kernel Git Commit Patch 3, Kernel Git Commit Patch 4, Kernel Git Commit Patch 5, Kernel Git Commit Patch 6, and Kernel Git Commit Patch 7. Distribution maintainers should pick the commit matching their stable branch.

Workarounds

Avoid invoking rm or unlink against primary_epc or secondary_epc symlinks under configfs until the patch is applied.
Tighten Linux capability assignments so that only verified service accounts can mount or write to configfs.
Where PCI endpoint functionality is unused, unload pci-epf-core and related modules to remove the vulnerable code path.

bash

# Configuration example
# Verify whether the PCI endpoint framework is loaded
lsmod | grep -E 'pci_epf|pci_epc'

# Restrict access to the configfs PCI endpoint tree
chmod 700 /sys/kernel/config/pci_ep

# Unload PCI endpoint modules on systems that do not use endpoint mode
modprobe -r pci_epf_test pci_epf_ntb pci_epf_core