CVE-2026-43145

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: imx_rproc: Fix invalid loaded resource table detection

imx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded

resource table even when the current firmware does not provide one.

When the device tree contains a "rsc-table" entry, priv->rsc_table is

non-NULL and denotes where a resource table would be located if one is

present in memory. However, when the current firmware has no resource

table, rproc->table_ptr is NULL. The function still returns

priv->rsc_table, and the remoteproc core interprets this as a valid loaded

resource table.

Fix this by returning NULL from imx_rproc_elf_find_loaded_rsc_table() when

there is no resource table for the current firmware (i.e. when

rproc->table_ptr is NULL). This aligns the function's semantics with the

remoteproc core: a loaded resource table is only reported when a valid

table_ptr exists.

With this change, starting firmware without a resource table

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References