Answer in brief
CVE-2026-43232 records a High severity (CVSS 8.8) vulnerability in net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=51e2d1b84acac39f79cacb60e6e154ce00a9d308 <cac048ebfbb92d91d719f74b59177cb70a7633b8 || >=998b4e54f517961d3d75144c088a24423e003005 <086131807d119238cd464e5b0845e48d938dfd79 || >=bb1715a6bfb0c57a68524732a376498a2569f016 <ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc || >=2f623aaf9f31de968dea6169849706a2f9be444c <337d7b4112a47984ee319171b75b73bab47e7924 || >=2f623aaf9f31de968dea6169849706a2f9be444c <200bdb8d367ca9b478f9c56ebe56411604d55c81 || >=2f623aaf9f31de968dea6169849706a2f9be444c <21d341fe514fd07e345ed264c9eee21cb2061ca2 || >=2f623aaf9f31de968dea6169849706a2f9be444c <04edfdfdfcdefc02408ab670607261b0a0a9a02e || >=2f623aaf9f31de968dea6169849706a2f9be444c <bae8a5d2e759da2e0cba33ab2080deee96a09373 || 41798a063fd4721b609e11ad839b6820f5070ca7 || b1fe377b43c405b169cffd1b3aa39c1dde16f3ed || ce9dc768767bbe73d2dd330a9075e849cb8a84d4 || 0c5f2c7700cb18aeab1574588d3bb9c0454bf228 || 024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9 || >=5.10.163 <5.10.252 || >=5.15.86 <5.15.202 || >=6.1.2 <6.1.165 || >=4.9.337 <4.10 || >=4.14.303 <4.15 || >=4.19.270 <4.20 || >=5.4.229 <5.5 || >=6.0.16 <6.1 | cac048ebfbb92d91d719f74b59177cb70a7633b8, 086131807d119238cd464e5b0845e48d938dfd79, ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc, 337d7b4112a47984ee319171b75b73bab47e7924, 200bdb8d367ca9b478f9c56ebe56411604d55c81, 21d341fe514fd07e345ed264c9eee21cb2061ca2, 04edfdfdfcdefc02408ab670607261b0a0a9a02e, bae8a5d2e759da2e0cba33ab2080deee96a09373, 5.10.252, 5.15.202, 6.1.165, 4.10, 4.15, 4.20, 5.5, 6.1 |
| Linux/Linuxgeneric | 6.2 | Not reported |
Published upstream
May 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs when the already freed fst_card_info is accessed in fst_process_tx_work_q() or fst_process_int_work_q(). A typical race condition is depicted below: CPU 0 (cleanup) | CPU 1 (tasklet) | fst_start_xmit() fst_remove_one() | tasklet_schedule() unregister_hdlc_device()| | fst_process_tx_work_q() //handler kfree(card) //free | do_bottom_half_tx() | card-> //use The following KASAN trace was captured: ================================================================== BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 ? do_bottom_half_tx+0xb88/0xd00 kasan_report+0xb8/0xf0 ? do_bottom_half_tx+0xb88/0xd00 do_bottom_half_tx+0xb88/0xd00 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx___hrtimer_run_queues+0x10/0x10 fst_process_tx_work_q+0x67/0x90 tasklet_action_common+0x1fa/0x720 ? hrtimer_interrupt+0x31f/0x780 handle_softirqs+0x176/0x530 __irq_exit_rcu+0xab/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 41 on cpu 3 at 72.330843s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 fst_add_one+0x1a5/0x1cd0 local_pci_probe+0xdd/0x190 pci_device_probe+0x341/0x480 really_probe+0x1c6/0x6a0 __driver_probe_device+0x248/0x310 driver_probe_device+0x48/0x210 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x101/0x190 __device_attach+0x198/0x3a0 device_initial_probe+0x78/0xa0 pci_bus_add_device+0x81/0xc0 pci_bus_add_devices+0x7e/0x190 enable_slot+0x9b9/0x1130 acpiphp_check_bridge.part.0+0x2e1/0x460 acpiphp_hotplug_notify+0x36c/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... Freed by task 41 on cpu 1 at 75.138639s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x135/0x410 fst_remove_one+0x2ca/0x540 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0x364/0x530 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device+0xd/0x20 disable_slot+0x116/0x260 acpiphp_disable_and_eject_slot+0x4b/0x190 acpiphp_hotplug_notify+0x230/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800aad1000: fa fb ---truncated---
Quoted source text, attributed separately from HOL analysis.