CVE-2026-43259 Overview
CVE-2026-43259 affects the Linux kernel phy/fsl-imx8mq-usb USB PHY driver for the NXP i.MX8MQ platform. The driver omits a required platform_set_drvdata() call during probe. The remove() callback later retrieves driver-private data through platform_get_drvdata(), which returns NULL. This produces undefined behavior on driver unbind or module removal. The upstream maintainers resolved the defect with three stable-tree commits referenced in the kernel git logs. The advisory does not include a CVSS score, attack vector, or CWE identifier, and no exploit is publicly available.
Critical Impact
A null driver-data pointer reached in the remove() path of the i.MX8MQ USB PHY driver can cause kernel instability when the driver is unbound or unloaded.
Affected Products
- Linux kernel builds including the phy-fsl-imx8mq-usb driver
- NXP i.MX8MQ-based systems using the USB PHY driver
- Stable kernel branches prior to the fix commits 06db8c06d948, 42d9509161d0, and debf8326a435
Discovery Timeline
- 2026-05-06 - CVE-2026-43259 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43259
Vulnerability Analysis
The phy-fsl-imx8mq-usb driver implements a USB PHY interface for NXP i.MX8MQ SoCs. During probe(), the driver allocates and initializes a private context structure but does not associate that pointer with the underlying struct platform_device through platform_set_drvdata(). The remove() callback assumes the pointer is recoverable using platform_get_drvdata(). Without the corresponding setter call, the getter returns NULL. Any subsequent dereference of that pointer in remove() triggers a null pointer dereference in kernel context.
The condition is reachable on driver unbind through sysfs, on module unload of phy-fsl-imx8mq-usb, or during device teardown sequences. The fault occurs in privileged kernel code paths and results in a kernel oops or panic depending on configuration. Reachability requires local privileges sufficient to trigger driver removal on an affected i.MX8MQ system.
Root Cause
The root cause is a missing platform_set_drvdata() invocation in the probe routine of the phy-fsl-imx8mq-usb driver. The defect is a coding omission rather than a logic flaw in the PHY state machine. The fix adds the call so that remove() retrieves a valid pointer to the driver context. The defect aligns with [CWE-476] (NULL Pointer Dereference) although the advisory does not assign a formal CWE.
Attack Vector
The issue manifests when an actor with local privileges to manage kernel modules or unbind platform devices triggers driver removal. There is no remote attack surface. The advisory lists no CVSS metrics, no known exploitation, and no CISA KEV entry. Practical impact is limited to availability on systems that load this PHY driver.
The vulnerability is a kernel coding defect, not a memory-corruption primitive. See the kernel commit logs for the exact diff and fix context: Kernel Git Commit 06db8c06d948, Kernel Git Commit 42d9509161d0, and Kernel Git Commit debf8326a435.
Detection Methods for CVE-2026-43259
Indicators of Compromise
- Kernel oops or panic messages referencing phy-fsl-imx8mq-usb and a null pointer dereference in the remove() path
- Crash traces produced when unbinding the driver via /sys/bus/platform/drivers/phy-fsl-imx8mq-usb/unbind
- Module unload failures or system instability following rmmod phy-fsl-imx8mq-usb
Detection Strategies
- Inventory running kernels on i.MX8MQ devices and compare versions against the stable commits 06db8c06d948, 42d9509161d0, and debf8326a435
- Audit dmesg and persistent kernel logs for null pointer dereference traces involving the i.MX8MQ USB PHY driver
- Track module load and unload events for phy-fsl-imx8mq-usb to identify systems exercising the affected code path
Monitoring Recommendations
- Forward kernel logs from embedded and edge Linux fleets to a centralized log platform for crash-trace correlation
- Alert on repeated kernel oops events tied to platform driver remove paths on i.MX8MQ hardware
- Monitor patch state of long-term-support kernel branches deployed on NXP i.MX8MQ products
How to Mitigate CVE-2026-43259
Immediate Actions Required
- Apply the upstream fix commits to all kernel builds containing phy-fsl-imx8mq-usb on i.MX8MQ targets
- Restrict local privileged access that could trigger driver unbind or module unload on affected systems
- Validate vendor BSP and yocto layers shipping i.MX8MQ kernels for inclusion of the patched driver
Patch Information
The fix adds the missing platform_set_drvdata() call in the probe path of phy-fsl-imx8mq-usb. Stable backports are tracked under Kernel Git Commit 06db8c06d948, Kernel Git Commit 42d9509161d0, and Kernel Git Commit debf8326a435. Rebuild and redeploy kernel images for affected i.MX8MQ devices after applying the patches.
Workarounds
- Avoid unbinding or unloading the phy-fsl-imx8mq-usb driver on unpatched systems
- Limit access to root and to interfaces under /sys/bus/platform/drivers/ that allow driver removal
- Pin the affected module as built-in where unload is not operationally required, reducing reachability of the remove() path
# Verify the running kernel does not allow unprivileged driver unbind
ls -l /sys/bus/platform/drivers/phy-fsl-imx8mq-usb/unbind
# Confirm the patched commit is present in the kernel source tree
git log --oneline drivers/phy/freescale/phy-fsl-imx8mq-usb.c | \
grep -E '06db8c06d948|42d9509161d0|debf8326a435'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
