{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-43232",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-05-01T14:12:55.995Z",
        "datePublished": "2026-05-06T11:28:28.910Z",
        "dateUpdated": "2026-08-05T12:26:45.086Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:26:45.086Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-> //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  <IRQ>\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n >ffff88800aad1000: fa fb\n---truncated---"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:N - The vulnerable tasklets can be queued by received frames/interrupts from a remote peer on the FarSync HDLC/WAN network link. The required device detach is accounted for under UI.\nAC:L - An attacker can keep RX/interrupt work pending by continuously sending traffic, and the bug is an unsynchronized tasklet teardown rather than a condition requiring special memory layout. The race is therefore reasonably triggerable during detach.\nPR:N - The remote peer does not need local privileges or authentication to generate receive interrupts that queue the vulnerable work. Administrative privilege is only needed for the victim-side detach action, not for the attacker’s network input.\nUI:R - The remote attack scenario requires another user or administrator to detach, unbind, hot-unplug, or unload the FarSync device while tasklet work is pending. Without that detach path, the freed-card use-after-free is not reached.\nS:U - The bug is within a kernel device driver and impacts kernel memory in the same security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - This is a slab use-after-free of the kmalloc-1k fst_card_info object, whose stale pointers and state are dereferenced by tasklet handlers. Kernel UAFs can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The freed card object controls subsequent I/O, DMA/status updates, queue handling, and netdev/port state accesses. As kernel UAF memory corruption, it can plausibly be shaped into write/control-flow corruption, so integrity impact is High.\nA:H - The reported KASAN trace shows a slab-use-after-free in softirq/tasklet context, which can crash or panic the kernel. Repeated triggering during detach can therefore cause high availability impact."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wan/farsync.c"
                    ],
                    "versions": [
                        {
                            "version": "51e2d1b84acac39f79cacb60e6e154ce00a9d308",
                            "lessThan": "cac048ebfbb92d91d719f74b59177cb70a7633b8",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "998b4e54f517961d3d75144c088a24423e003005",
                            "lessThan": "086131807d119238cd464e5b0845e48d938dfd79",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "bb1715a6bfb0c57a68524732a376498a2569f016",
                            "lessThan": "ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
                            "lessThan": "337d7b4112a47984ee319171b75b73bab47e7924",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
                            "lessThan": "200bdb8d367ca9b478f9c56ebe56411604d55c81",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
                            "lessThan": "21d341fe514fd07e345ed264c9eee21cb2061ca2",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
                            "lessThan": "04edfdfdfcdefc02408ab670607261b0a0a9a02e",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2f623aaf9f31de968dea6169849706a2f9be444c",
                            "lessThan": "bae8a5d2e759da2e0cba33ab2080deee96a09373",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "41798a063fd4721b609e11ad839b6820f5070ca7",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b1fe377b43c405b169cffd1b3aa39c1dde16f3ed",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "ce9dc768767bbe73d2dd330a9075e849cb8a84d4",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "0c5f2c7700cb18aeab1574588d3bb9c0454bf228",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "5.10.163",
                            "lessThan": "5.10.252",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.86",
                            "lessThan": "5.15.202",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.2",
                            "lessThan": "6.1.165",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.9.337",
                            "lessThan": "4.10",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.14.303",
                            "lessThan": "4.15",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.19.270",
                            "lessThan": "4.20",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.4.229",
                            "lessThan": "5.5",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0.16",
                            "lessThan": "6.1",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wan/farsync.c"
                    ],
                    "versions": [
                        {
                            "version": "6.2",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.2",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.252",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.202",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.165",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.128",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.75",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.16",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.19.6",
                            "lessThanOrEqual": "6.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.10.163",
                                    "versionEndExcluding": "5.10.252"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.15.86",
                                    "versionEndExcluding": "5.15.202"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.1.2",
                                    "versionEndExcluding": "6.1.165"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.2",
                                    "versionEndExcluding": "6.6.128"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.2",
                                    "versionEndExcluding": "6.12.75"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.2",
                                    "versionEndExcluding": "6.18.16"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.2",
                                    "versionEndExcluding": "6.19.6"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.2",
                                    "versionEndExcluding": "7.0"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.9.337"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.14.303"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.19.270"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.4.229"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.0.16"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"
                },
                {
                    "url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"
                },
                {
                    "url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"
                },
                {
                    "url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"
                },
                {
                    "url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"
                },
                {
                    "url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"
                },
                {
                    "url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"
                }
            ],
            "title": "net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}