{"api_version":"1","generated_at":"2026-05-08T04:09:22+00:00","cve":"CVE-2026-43232","urls":{"html":"https://cve.report/CVE-2026-43232","api":"https://cve.report/api/cve/CVE-2026-43232.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-43232","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-43232"},"summary":{"title":"net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-> //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  <IRQ>\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n >ffff88800aad1000: fa fb\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2026-05-06 12:16:43","updated_at":"2026-05-06 13:07:51"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2","name":"https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373","name":"https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e","name":"https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8","name":"https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81","name":"https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc","name":"https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79","name":"https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924","name":"https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43232","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43232","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 51e2d1b84acac39f79cacb60e6e154ce00a9d308 cac048ebfbb92d91d719f74b59177cb70a7633b8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 998b4e54f517961d3d75144c088a24423e003005 086131807d119238cd464e5b0845e48d938dfd79 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bb1715a6bfb0c57a68524732a376498a2569f016 ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2f623aaf9f31de968dea6169849706a2f9be444c 337d7b4112a47984ee319171b75b73bab47e7924 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2f623aaf9f31de968dea6169849706a2f9be444c 200bdb8d367ca9b478f9c56ebe56411604d55c81 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2f623aaf9f31de968dea6169849706a2f9be444c 21d341fe514fd07e345ed264c9eee21cb2061ca2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2f623aaf9f31de968dea6169849706a2f9be444c 04edfdfdfcdefc02408ab670607261b0a0a9a02e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2f623aaf9f31de968dea6169849706a2f9be444c bae8a5d2e759da2e0cba33ab2080deee96a09373 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 41798a063fd4721b609e11ad839b6820f5070ca7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b1fe377b43c405b169cffd1b3aa39c1dde16f3ed git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ce9dc768767bbe73d2dd330a9075e849cb8a84d4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0c5f2c7700cb18aeab1574588d3bb9c0454bf228 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.2","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.252 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.202 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.165 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.128 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.75 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.16 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19.6 6.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wan/farsync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cac048ebfbb92d91d719f74b59177cb70a7633b8","status":"affected","version":"51e2d1b84acac39f79cacb60e6e154ce00a9d308","versionType":"git"},{"lessThan":"086131807d119238cd464e5b0845e48d938dfd79","status":"affected","version":"998b4e54f517961d3d75144c088a24423e003005","versionType":"git"},{"lessThan":"ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc","status":"affected","version":"bb1715a6bfb0c57a68524732a376498a2569f016","versionType":"git"},{"lessThan":"337d7b4112a47984ee319171b75b73bab47e7924","status":"affected","version":"2f623aaf9f31de968dea6169849706a2f9be444c","versionType":"git"},{"lessThan":"200bdb8d367ca9b478f9c56ebe56411604d55c81","status":"affected","version":"2f623aaf9f31de968dea6169849706a2f9be444c","versionType":"git"},{"lessThan":"21d341fe514fd07e345ed264c9eee21cb2061ca2","status":"affected","version":"2f623aaf9f31de968dea6169849706a2f9be444c","versionType":"git"},{"lessThan":"04edfdfdfcdefc02408ab670607261b0a0a9a02e","status":"affected","version":"2f623aaf9f31de968dea6169849706a2f9be444c","versionType":"git"},{"lessThan":"bae8a5d2e759da2e0cba33ab2080deee96a09373","status":"affected","version":"2f623aaf9f31de968dea6169849706a2f9be444c","versionType":"git"},{"status":"affected","version":"41798a063fd4721b609e11ad839b6820f5070ca7","versionType":"git"},{"status":"affected","version":"b1fe377b43c405b169cffd1b3aa39c1dde16f3ed","versionType":"git"},{"status":"affected","version":"ce9dc768767bbe73d2dd330a9075e849cb8a84d4","versionType":"git"},{"status":"affected","version":"0c5f2c7700cb18aeab1574588d3bb9c0454bf228","versionType":"git"},{"status":"affected","version":"024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wan/farsync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.252","versionStartIncluding":"5.10.163","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.202","versionStartIncluding":"5.15.86","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.75","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.16","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.6","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.337","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.303","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.270","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.229","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-> //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  <IRQ>\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n >ffff88800aad1000: fa fb\n---truncated---"}],"providerMetadata":{"dateUpdated":"2026-05-06T11:28:28.910Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"},{"url":"https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"},{"url":"https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"},{"url":"https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"},{"url":"https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"},{"url":"https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"},{"url":"https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"},{"url":"https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"}],"title":"net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-43232","datePublished":"2026-05-06T11:28:28.910Z","dateReserved":"2026-05-01T14:12:55.995Z","dateUpdated":"2026-05-06T11:28:28.910Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-06 12:16:43","lastModifiedDate":"2026-05-06 13:07:51","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"43232","Ordinal":"1","Title":"net: wan: farsync: Fix use-after-free bugs caused by unfinished ","CVE":"CVE-2026-43232","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"43232","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\n                          | fst_start_xmit()\nfst_remove_one()          |   tasklet_schedule()\n  unregister_hdlc_device()|\n                          | fst_process_tx_work_q() //handler\n  kfree(card) //free      |   do_bottom_half_tx()\n                          |     card-> //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n  <IRQ>\n  dump_stack_lvl+0x55/0x70\n  print_report+0xcb/0x5d0\n  ? do_bottom_half_tx+0xb88/0xd00\n  kasan_report+0xb8/0xf0\n  ? do_bottom_half_tx+0xb88/0xd00\n  do_bottom_half_tx+0xb88/0xd00\n  ? _raw_spin_lock_irqsave+0x85/0xe0\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  ? __pfx___hrtimer_run_queues+0x10/0x10\n  fst_process_tx_work_q+0x67/0x90\n  tasklet_action_common+0x1fa/0x720\n  ? hrtimer_interrupt+0x31f/0x780\n  handle_softirqs+0x176/0x530\n  __irq_exit_rcu+0xab/0xe0\n  sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  __kasan_kmalloc+0x7f/0x90\n  fst_add_one+0x1a5/0x1cd0\n  local_pci_probe+0xdd/0x190\n  pci_device_probe+0x341/0x480\n  really_probe+0x1c6/0x6a0\n  __driver_probe_device+0x248/0x310\n  driver_probe_device+0x48/0x210\n  __device_attach_driver+0x160/0x320\n  bus_for_each_drv+0x101/0x190\n  __device_attach+0x198/0x3a0\n  device_initial_probe+0x78/0xa0\n  pci_bus_add_device+0x81/0xc0\n  pci_bus_add_devices+0x7e/0x190\n  enable_slot+0x9b9/0x1130\n  acpiphp_check_bridge.part.0+0x2e1/0x460\n  acpiphp_hotplug_notify+0x36c/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n  kasan_save_stack+0x24/0x50\n  kasan_save_track+0x17/0x60\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x43/0x70\n  kfree+0x135/0x410\n  fst_remove_one+0x2ca/0x540\n  pci_device_remove+0xa6/0x1d0\n  device_release_driver_internal+0x364/0x530\n  pci_stop_bus_device+0x105/0x150\n  pci_stop_and_remove_bus_device+0xd/0x20\n  disable_slot+0x116/0x260\n  acpiphp_disable_and_eject_slot+0x4b/0x190\n  acpiphp_hotplug_notify+0x230/0x3c0\n  acpi_device_hotplug+0x203/0xb10\n  acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n  freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n >ffff88800aad1000: fa fb\n---truncated---","Type":"Description","Title":"net: wan: farsync: Fix use-after-free bugs caused by unfinished "}]}}}