CVE-2026-43473: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43473 Overview

CVE-2026-43473 is a NULL pointer dereference vulnerability in the Linux kernel's mpi3mr SCSI driver. The flaw exists in the cleanup path for reply and request queues used by Broadcom MPI3 storage controllers. When queue allocation fails, the driver frees memory and then attempts to memset the freed regions, triggering a system crash. The maintainers resolved the issue by adding NULL pointer checks before accessing reply and request queue memory during cleanup.

Critical Impact
Local conditions that trigger reply or request queue allocation failures can crash the kernel, producing a denial-of-service condition on hosts using affected mpi3mr-backed storage hardware.

Affected Products

Linux kernel scsi: mpi3mr driver (Broadcom MPI3 storage controller driver)
Upstream stable kernel branches prior to the commits referenced in the kernel.org advisory
Distribution kernels that have not yet backported the fix

Discovery Timeline

2026-05-08 - CVE-2026-43473 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43473

Vulnerability Analysis

The mpi3mr driver manages submission and completion queues that the host uses to communicate with Broadcom MPI3 storage controllers. During initialization, the driver allocates an array of reply queues and request queues. If allocation fails partway through setup, the driver invokes its cleanup routine. The cleanup routine previously released the queue memory and then attempted to zero the contents of the same memory using memset. Writing to freed memory dereferences pointers that are no longer valid, producing a kernel oops.

The condition is reachable whenever queue creation fails, for example under memory pressure or controller initialization errors. Because the crash occurs inside kernel context during device probe or reset, the system halts rather than gracefully recovering from the storage initialization failure.

Root Cause

The root cause is a use-after-free style bug: the cleanup path frees queue structures before clearing their contents [CWE-476, CWE-416]. The fix adds explicit NULL pointer checks for reply and request queues before performing any memset or pointer access during cleanup. The patches are documented in the upstream commits referenced below.

Attack Vector

No network attack vector exists. Triggering the bug requires conditions that cause mpi3mr queue allocation to fail on a host with affected hardware. A local actor with the ability to induce memory pressure, controller resets, or hot-plug events on a vulnerable system could in principle reach the faulty cleanup path, resulting in a kernel crash and denial of service.

No verified public exploit or proof-of-concept code is available. The vulnerability mechanism is described in the upstream commit messages:

Detection Methods for CVE-2026-43473

Indicators of Compromise

Kernel oops or panic messages referencing mpi3mr symbols, particularly cleanup, reply queue, or request queue functions
Unplanned host reboots correlated with MPI3 controller initialization or reset events
dmesg entries showing queue allocation failures immediately preceding a crash

Detection Strategies

Inventory running kernels and compare against the fixed versions identified in the upstream stable commits
Check whether the mpi3mr module is loaded with lsmod | grep mpi3mr on Linux hosts attached to Broadcom MPI3 storage
Review crash dumps and kernel logs for stack traces involving mpi3mr cleanup routines

Monitoring Recommendations

Forward kernel logs and crash artifacts to a centralized logging or SIEM platform for correlation across hosts
Alert on repeated mpi3mr allocation failures or controller resets, which indicate proximity to the vulnerable code path
Track kernel version drift across the fleet to confirm patch rollout completion

How to Mitigate CVE-2026-43473

Immediate Actions Required

Identify hosts running the mpi3mr driver against Broadcom MPI3 storage controllers
Apply distribution kernel updates that include the upstream NULL-check commits referenced above
Schedule reboots on affected systems to load the patched kernel

Patch Information

The fix adds NULL pointer checks for reply and request queues before accessing their memory during cleanup. Patches have been merged across multiple stable branches. Apply the kernel package update provided by your Linux distribution, or rebuild from a stable branch that includes commits 220d7ca, 78d3f20, 7da755e, 7df0296, e978a36, or fa96392 as appropriate for your kernel version.

Workarounds

No supported workaround exists at the driver level; patching the kernel is the resolution path
On systems that do not require MPI3 storage, blacklisting the mpi3mr module removes exposure but disables the affected controllers
Maintain stable operating conditions, sufficient memory headroom, and minimize controller reset events until the patch is deployed

bash

# Verify whether the mpi3mr driver is loaded and check kernel version
uname -r
lsmod | grep mpi3mr

# Optional: blacklist the module if MPI3 storage is not required
echo "blacklist mpi3mr" | sudo tee /etc/modprobe.d/blacklist-mpi3mr.conf
sudo update-initramfs -u