CVE-2026-43007 Details
Description
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away.
A vulnerability exists in the Linux kernel's handling of Deactivation Bus Controller (DBC) resources within the QAIC (Qualcomm AI Compute) framework. When a DBC is released, the device sends a deactivation transaction to the host over the QAIC_CONTROL MHI channel. This transaction is processed by the QAIC management ioctl context. If the user disconnects before the deactivation is acknowledged, the host becomes misaligned with the available DBCs, causing the resources to remain allocated until the device is physically removed. Consequently, if another user activates a network, the same DBC is reassigned, leading to a deadlock as QAIC waits indefinitely for the DBC to be freed, causing the user process to hang. The vulnerability arises because the deactivation transactions are not properly handled if the user has already disconnected.
The vulnerability has been addressed by modifying the QAIC control path to properly handle deactivation transactions that arrive after the user has disconnected. Users can apply the latest patches available in the Linux kernel stable tree to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/08021f2d4a557d6491e3bcc288e96425f50aa3cf | kernel.org | Patch |
| https://git.kernel.org/stable/c/2dd67966f39a2abf8ccb4865031c722e40e01b7f | kernel.org | Patch |
| https://git.kernel.org/stable/c/2feec5ae5df785658924ab6bd91280dc3926507c | kernel.org | Patch |
| https://git.kernel.org/stable/c/ee0180e77e6c8482644569632065411de844c515 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f403094d9075d7c565a3d81002b781c325cb3c07 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.4, < 6.6.134 >= 6.7, < 6.12.81 >= 6.13, < 6.18.22 >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | kernel.org |