CVE-2026-43462 Overview
CVE-2026-43462 is a memory leak vulnerability in the Linux kernel's SpacemiT Ethernet MAC (EMAC) network driver. The flaw resides in the emac_tx_mem_map() function, which failed to release Direct Memory Access (DMA) mappings when an error occurred during the mapping process. Repeated mapping failures progressively exhaust DMA resources, leading to availability impact on affected systems. The fix releases the leaked mappings using the existing emac_free_tx_buf() cleanup function.
Critical Impact
Repeated DMA mapping errors in the SpacemiT EMAC driver leak kernel resources, enabling resource exhaustion and denial-of-service conditions on affected Linux systems.
Affected Products
- Linux kernel versions containing the SpacemiT EMAC network driver prior to the upstream fix
- Systems using SpacemiT EMAC hardware with the vulnerable emac_tx_mem_map() code path
- Stable kernel branches referenced by the upstream commits prior to backporting
Discovery Timeline
- 2026-05-08 - CVE-2026-43462 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43462
Vulnerability Analysis
The vulnerability resides in the SpacemiT EMAC network driver located under drivers/net/ethernet/spacemit/. The emac_tx_mem_map() function prepares transmit (TX) buffers by establishing DMA mappings between kernel memory and device-accessible memory. When a mapping operation failed partway through processing, the function returned an error without unmapping the DMA regions that had already been successfully mapped.
Each leaked mapping consumes IOMMU entries, bounce buffer slots, and associated bookkeeping structures. Sustained mapping failures under load drain these finite resources. The result is a kernel-level memory leak that degrades network functionality and can render the system unable to allocate further DMA mappings.
The upstream resolution invokes emac_free_tx_buf() on the error path. This existing helper iterates over previously mapped buffers and releases them through the appropriate DMA unmap calls, restoring proper resource accounting.
Root Cause
The root cause is improper error-path cleanup [CWE-401: Missing Release of Memory after Effective Lifetime]. The original implementation of emac_tx_mem_map() lacked a rollback routine for partially completed DMA mappings. Kernel DMA APIs require explicit unmapping; abandoning mapped regions on failure leaves them allocated for the lifetime of the driver instance.
Attack Vector
The issue is reachable through normal network transmit operations on hardware using the SpacemiT EMAC driver. An attacker capable of inducing DMA mapping failures—for example, through crafted network workloads that stress the TX path under low-memory or IOMMU-constrained conditions—can repeatedly trigger the leak. Continued exploitation exhausts DMA resources and produces a denial-of-service condition affecting kernel availability.
No synthetic exploitation code is included here. The corrective patches are available in the upstream Linux kernel tree as commits 86292155bea5, c34ebd7b24ea, and edeaba385318.
Detection Methods for CVE-2026-43462
Indicators of Compromise
- Kernel log entries from the SpacemiT EMAC driver reporting TX mapping errors or dma_map_single failures.
- Progressive growth in IOMMU mapping counts visible via /sys/kernel/debug/iommu/ without corresponding unmaps.
- Network interface stalls, dropped TX packets, or NETDEV WATCHDOG timeouts on SpacemiT EMAC interfaces.
- Increasing dma-mapping slab usage reported by /proc/slabinfo over extended runtime.
Detection Strategies
- Compare running kernel versions against the patched commits 86292155bea5, c34ebd7b24ea, and edeaba385318 using configuration management tooling.
- Monitor kernel ring buffer (dmesg) for repeated DMA mapping failure messages originating in the SpacemiT EMAC driver.
- Track DMA allocation metrics through tracepoints such as dma_map_page and dma_unmap_page for imbalance.
Monitoring Recommendations
- Collect kernel logs centrally and alert on patterns of DMA mapping errors on affected hardware platforms.
- Baseline IOMMU and slab memory usage on SpacemiT-based systems and flag sustained upward trends.
- Track network interface error counters via ethtool -S for anomalous growth in TX drops.
How to Mitigate CVE-2026-43462
Immediate Actions Required
- Inventory all Linux systems running the SpacemiT EMAC driver and identify kernel versions in use.
- Apply the upstream stable kernel update containing commits 86292155bea5, c34ebd7b24ea, and edeaba385318.
- Reboot affected systems after the patched kernel is installed to load the corrected driver.
Patch Information
The fix is published in the upstream Linux stable tree. Refer to the Kernel Git Commit Change, Kernel Git Commit Update, and Kernel Git Commit Fix. Distribution maintainers should backport these commits to supported kernel branches.
Workarounds
- Where patching is not immediately possible, restrict network workloads that stress the TX path on SpacemiT EMAC interfaces.
- Schedule periodic reboots on affected systems to reclaim leaked DMA mappings until the patched kernel is deployed.
- Disable or unbind the SpacemiT EMAC driver on systems where the interface is not required for production traffic.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
