CVE-2026-43203 Overview
CVE-2026-43203 is a use-after-free vulnerability in the Linux kernel's ATM fore200e driver, which supports PCA-200E and SBA-200E adapters. The flaw occurs during device removal when the fore200e structure is deallocated while tx_tasklet or rx_tasklet is still running or pending. Subsequent access to the freed memory in fore200e_tx_tasklet() or fore200e_rx_tasklet() triggers the use-after-free condition. The bug was identified through static analysis and resolved by adding tasklet_kill() synchronization in fore200e_shutdown() before releasing the driver state.
Critical Impact
A race condition between device teardown and pending tasklets allows kernel memory corruption, potentially leading to local denial of service or kernel memory disclosure on systems using fore200e ATM hardware.
Affected Products
- Linux kernel ATM subsystem fore200e driver
- Systems using ForeRunner PCA-200E PCI ATM adapters
- Systems using ForeRunner SBA-200E SBus ATM adapters
Discovery Timeline
- 2026-05-06 - CVE-2026-43203 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43203
Vulnerability Analysis
The vulnerability resides in the fore200e ATM driver, which handles ForeRunner PCA-200E and SBA-200E network adapters. During device detach, fore200e_pca_remove_one() invokes fore200e_shutdown() and ultimately calls kfree() on the fore200e driver state. However, the driver schedules deferred work using tx_tasklet and rx_tasklet, both of which dereference the fore200e pointer when they execute.
If fore200e_interrupt() schedules a tasklet immediately before or during the shutdown sequence, the tasklet may run after the structure has been freed. The race is illustrated by the sequence where CPU 0 runs fore200e_pca_remove_one() and frees the structure, while CPU 1 simultaneously executes fore200e_tx_tasklet() and dereferences the freed pointer.
Root Cause
The root cause is missing synchronization between tasklet teardown and driver state deallocation [CWE-416]. The original code did not call tasklet_kill() before freeing the fore200e structure. Pending or in-flight tasklets retained a stale pointer and accessed freed kernel memory when finally executed.
Attack Vector
Exploitation requires triggering device removal while the adapter is actively servicing interrupts. An attacker with physical access or sufficient privileges to unbind the driver can race the removal path against tasklet execution. The fix calls tasklet_kill() after fore200e_reset() and only when the driver state is at or above FORE200E_STATE_IRQ, since tasklets are uninitialized in earlier states. Placing tasklet_kill() after fore200e_reset() prevents the tasklet from being rescheduled by fore200e_interrupt().
No public proof-of-concept code exists for this issue. See the upstream commits referenced in Linux Kernel Commit 5189368 and Linux Kernel Commit 73fbc5d for the patch implementation details.
Detection Methods for CVE-2026-43203
Indicators of Compromise
- Kernel oops or panic messages referencing fore200e_tx_tasklet or fore200e_rx_tasklet in dmesg or /var/log/kern.log
- KASAN reports flagging use-after-free access within the fore200e driver
- Unexpected system crashes correlated with PCI hot-unplug or rmmod fore200e events
Detection Strategies
- Enable CONFIG_KASAN on test kernels to catch use-after-free dereferences in tasklet handlers at runtime
- Audit running kernels with uname -r and compare against fixed stable releases listed in the upstream commits
- Monitor module load and unload activity for the fore200e driver via auditd rules on init_module and delete_module syscalls
Monitoring Recommendations
- Forward kernel ring buffer messages to a centralized logging pipeline and alert on fore200e stack traces
- Track PCI device removal events through udev to correlate with subsequent kernel instability
- Inventory hosts running ATM hardware to scope the affected fleet, since ForeRunner adapters are uncommon in modern deployments
How to Mitigate CVE-2026-43203
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the official commit list as soon as your distribution publishes updated packages
- Identify systems with PCA-200E or SBA-200E adapters and prioritize them for kernel updates
- Avoid hot-unplugging or unbinding the fore200e driver on unpatched kernels carrying production traffic
Patch Information
The fix adds tasklet_kill() inside fore200e_shutdown() within the FORE200E_STATE_IRQ branch of the switch statement, placed after fore200e_reset() to prevent rescheduling. The patch is available across multiple stable branches via Linux Kernel Commit 8930878, Linux Kernel Commit 91f2574, Linux Kernel Commit 97900f5, Linux Kernel Commit aba0b4b, Linux Kernel Commit e075ec9, and Linux Kernel Commit e4ff4e3.
Workarounds
- Blacklist the fore200e module on systems that do not require ATM connectivity by adding blacklist fore200e to /etc/modprobe.d/blacklist.conf
- Restrict module unload privileges by limiting CAP_SYS_MODULE to trusted administrators only
- If removal is unavoidable, quiesce ATM traffic and disable the adapter via ifconfig before unbinding the driver
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
