CVE-2026-43007
Awaiting Analysis Awaiting Analysis - Queue
Race Condition in QAIC Driver Leads to System Hang

Publication date: 2026-05-01

Last updated on: 2026-05-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-01
Generated
2026-05-07
AI Q&A
2026-05-01
EPSS Evaluated
2026-05-05
NVD
CVE-2026-43007
EUVD
EUVD-2026-26606
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability occurs in the Linux kernel's QAIC accelerator driver. When a DBC (Dynamic Binary Code) is released, the device sends a deactivation transaction to the host to free resources. However, if the user who owns the DBC disconnects before the deactivation is handled, the host becomes out-of-sync with the actual DBCs available. This causes the resources allocated to that DBC to remain allocated indefinitely unless the device is removed.

If another user tries to activate a network using the same DBC, the system will wait indefinitely for the DBC to be marked as not in use, causing the user process to hang.

The fix involves handling deactivation transactions even after the original user has gone away, ensuring resources are properly freed.


How can this vulnerability impact me? :

This vulnerability can cause user processes to hang indefinitely when they attempt to activate a network using a DBC that is stuck in an in-use state due to improper resource deallocation.

It can lead to resource leaks where DBC resources are not freed unless the device is removed, potentially degrading system performance or causing denial of service conditions for users relying on these resources.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart