Answer in brief
CVE-2026-43203 records a High severity (CVSS 7.5) vulnerability in atm: fore200e: fix use-after-free in tasklets during device removal. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <91f25749aaf57c47ae1e12478144e6ea8c8562f2 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <73fbc5d1a9ccb626937500bbd67136f077d8237b || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <aba0b4bc09376dfc3d53c826514fe38fc8337f52 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e075ec9b08f862dade8011481058f7eb5f716c57 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <97900f512252a59f23d6ce4ab215cc88fed66e68 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e4ff4e3ffcf9d5aad380cdd1d8cdc008bb34f97d || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5189368f10903956be05062d160b2804bf5e5016 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8930878101cd40063888a68af73b1b0f8b6c79bc | 91f25749aaf57c47ae1e12478144e6ea8c8562f2, 73fbc5d1a9ccb626937500bbd67136f077d8237b, aba0b4bc09376dfc3d53c826514fe38fc8337f52, e075ec9b08f862dade8011481058f7eb5f716c57, 97900f512252a59f23d6ce4ab215cc88fed66e68, e4ff4e3ffcf9d5aad380cdd1d8cdc008bb34f97d, 5189368f10903956be05062d160b2804bf5e5016, 8930878101cd40063888a68af73b1b0f8b6c79bc |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
May 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: atm: fore200e: fix use-after-free in tasklets during device removal When the PCA-200E or SBA-200E adapter is being detached, the fore200e is deallocated. However, the tx_tasklet or rx_tasklet may still be running or pending, leading to use-after-free bug when the already freed fore200e is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet(). One of the race conditions can occur as follows: CPU 0 (cleanup) | CPU 1 (tasklet) fore200e_pca_remove_one() | fore200e_interrupt() fore200e_shutdown() | tasklet_schedule() kfree(fore200e) | fore200e_tx_tasklet() | fore200e-> // UAF Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to synchronize with any pending or running tasklets. Moreover, since fore200e_reset() could prevent further interrupts or data transfers, the tasklet_kill() should be placed after fore200e_reset() to prevent the tasklet from being rescheduled in fore200e_interrupt(). Finally, it only needs to do tasklet_kill() when the fore200e state is greater than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized in earlier states. In a word, the tasklet_kill() should be placed in the FORE200E_STATE_IRQ branch within the switch...case structure. This bug was identified through static analysis.
Quoted source text, attributed separately from HOL analysis.