CVE-2026-43232: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43232 Overview

CVE-2026-43232 is a use-after-free vulnerability in the Linux kernel's farsync WAN driver (net/wan/farsync). The flaw occurs during the detach sequence of a FarSync T-series card. When fst_remove_one() deallocates the fst_card_info structure, pending fst_tx_task or fst_int_task tasklets can still execute and reference the freed memory through fst_process_tx_work_q() or fst_process_int_work_q(). The condition was confirmed by KASAN, which captured a slab-use-after-free read inside do_bottom_half_tx(). The issue is classified as a kernel race condition leading to memory corruption [CWE-416].

Critical Impact

A race between device removal and pending tasklets allows kernel memory access after kfree(), which can lead to kernel memory corruption, information disclosure, or local privilege escalation on systems using FarSync T-series WAN hardware.

Affected Products

• Linux kernel versions containing the farsync WAN driver prior to the upstream fixes
• Distributions shipping the affected net/wan/farsync driver in stable trees referenced by the kernel.org patch series
• Systems using FarSync T-series PCI WAN adapters with the in-tree driver

Discovery Timeline

• 2026-05-06 - CVE-2026-43232 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43232

Vulnerability Analysis

The farsync driver schedules tasklets via tasklet_schedule() from fst_start_xmit() and from interrupt context. These tasklets later run fst_process_tx_work_q() and fst_process_int_work_q(), which dereference the per-card structure fst_card_info. The driver's removal path, fst_remove_one(), calls unregister_hdlc_device() and then kfree(card) without ensuring all pending tasklets have completed. As a result, a tasklet running on one CPU can dereference a card pointer after another CPU has freed it.

Root Cause

The root cause is missing synchronization between PCI device teardown and tasklet completion. The driver does not call tasklet_kill() on fst_tx_task and fst_int_task before releasing fst_card_info. Because tasklets execute in softirq context, scheduled work can run after unregister_hdlc_device() returns but before or during kfree(card), creating a use-after-free window.

Attack Vector

Triggering the bug requires the FarSync card to be detached while traffic or interrupt activity has scheduled tasklets. KASAN's report shows allocation by fst_add_one() during PCI hotplug probe and the free occurring through pci_device_remove() driven by acpiphp_disable_and_eject_slot(). A local attacker with the ability to induce PCI hotplug events, or physical access to remove the card under load, can race the cleanup path against the tasklet handler. The KASAN trace confirms the read of freed memory at do_bottom_half_tx+0xb88/0xd00 from ksoftirqd.

// Race condition (from the kernel commit message)
CPU 0 (cleanup)             | CPU 1 (tasklet)
                            | fst_start_xmit()
fst_remove_one()            |   tasklet_schedule()
  unregister_hdlc_device()  |
                            | fst_process_tx_work_q()
  kfree(card)  // free      |   do_bottom_half_tx()
                            |     card->...  // use-after-free

Detection Methods for CVE-2026-43232

Indicators of Compromise

• KASAN reports of slab-use-after-free in do_bottom_half_tx, fst_process_tx_work_q, or fst_process_int_work_q
• Kernel oops or panic referencing farsync symbols following PCI hotplug or module unload events
• Unexpected ksoftirqd crashes coinciding with FarSync card removal in dmesg

Detection Strategies

• Enable CONFIG_KASAN on test and staging kernels to surface use-after-free conditions in the farsync driver
• Monitor kernel ring buffer for BUG: KASAN and general protection fault entries containing fst_ symbol prefixes
• Audit loaded kernel modules for farsync on production hosts and inventory hardware that uses FarSync T-series adapters

Monitoring Recommendations

• Forward /var/log/kern.log and journalctl -k output to a central log platform and alert on farsync and KASAN strings
• Track PCI hotplug events via udev and correlate with subsequent kernel faults
• Watch for unexpected reboots or kernel panics on hosts equipped with WAN adapters that load the farsync module

How to Mitigate CVE-2026-43232

Immediate Actions Required

• Apply the upstream kernel patches that add proper tasklet teardown to the farsync removal path before freeing fst_card_info
• Update to a distribution kernel that incorporates the fix from the stable trees referenced by the kernel.org commits
• Where patching is not yet possible, blacklist the farsync module on systems that do not require FarSync WAN hardware

Patch Information

The fix has been committed to multiple stable kernel branches. Reference commits include Kernel Patch 04edfdfd, Kernel Patch 08613180, Kernel Patch 200bdb8d, Kernel Patch 21d341fe, Kernel Patch 337d7b41, Kernel Patch ae894e47, Kernel Patch bae8a5d2, and Kernel Patch cac048eb.

Workarounds

• Prevent loading of the affected driver on hosts that do not need it by blacklisting it in /etc/modprobe.d/
• Restrict physical and administrative access that would allow PCI hotplug eject events on systems using FarSync hardware
• Avoid removing or hot-ejecting FarSync T-series cards while the interface is carrying traffic on unpatched kernels

# Configuration example: blacklist the vulnerable driver until patched
echo "blacklist farsync" | sudo tee /etc/modprobe.d/blacklist-farsync.conf
sudo depmod -a
sudo update-initramfs -u   # Debian/Ubuntu
# or: sudo dracut -f      # RHEL/Fedora
# Verify the module is not loaded
lsmod | grep -i farsync