CVE-2026-43007

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

accel/qaic: Handle DBC deactivation if the owner went away

When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV

transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles

this by calling decode_deactivate() to release the resources allocated for

that DBC. Since that handling is done in the qaic_manage_ioctl() context,

if the user goes away before receiving and handling the deactivation, the

host will be out-of-sync with the DBCs available for use, and the DBC

resources will not be freed unless the device is removed. If another user

loads and requests to activate a network, then the device assigns the same

DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,

leading the user process to hang.

As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions

that are received after the user has gone away.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References