CVE-2026-43232

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets<br /> <br /> When the FarSync T-series card is being detached, the fst_card_info is<br /> deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task<br /> may still be running or pending, leading to use-after-free bugs when the<br /> already freed fst_card_info is accessed in fst_process_tx_work_q() or<br /> fst_process_int_work_q().<br /> <br /> A typical race condition is depicted below:<br /> <br /> CPU 0 (cleanup) | CPU 1 (tasklet)<br /> | fst_start_xmit()<br /> fst_remove_one() | tasklet_schedule()<br /> unregister_hdlc_device()|<br /> | fst_process_tx_work_q() //handler<br /> kfree(card) //free | do_bottom_half_tx()<br /> | card-&gt; //use<br /> <br /> The following KASAN trace was captured:<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00<br /> Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32<br /> ...<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x55/0x70<br /> print_report+0xcb/0x5d0<br /> ? do_bottom_half_tx+0xb88/0xd00<br /> kasan_report+0xb8/0xf0<br /> ? do_bottom_half_tx+0xb88/0xd00<br /> do_bottom_half_tx+0xb88/0xd00<br /> ? _raw_spin_lock_irqsave+0x85/0xe0<br /> ? __pfx__raw_spin_lock_irqsave+0x10/0x10<br /> ? __pfx___hrtimer_run_queues+0x10/0x10<br /> fst_process_tx_work_q+0x67/0x90<br /> tasklet_action_common+0x1fa/0x720<br /> ? hrtimer_interrupt+0x31f/0x780<br /> handle_softirqs+0x176/0x530<br /> __irq_exit_rcu+0xab/0xe0<br /> sysvec_apic_timer_interrupt+0x70/0x80<br /> ...<br /> <br /> Allocated by task 41 on cpu 3 at 72.330843s:<br /> kasan_save_stack+0x24/0x50<br /> kasan_save_track+0x17/0x60<br /> __kasan_kmalloc+0x7f/0x90<br /> fst_add_one+0x1a5/0x1cd0<br /> local_pci_probe+0xdd/0x190<br /> pci_device_probe+0x341/0x480<br /> really_probe+0x1c6/0x6a0<br /> __driver_probe_device+0x248/0x310<br /> driver_probe_device+0x48/0x210<br /> __device_attach_driver+0x160/0x320<br /> bus_for_each_drv+0x101/0x190<br /> __device_attach+0x198/0x3a0<br /> device_initial_probe+0x78/0xa0<br /> pci_bus_add_device+0x81/0xc0<br /> pci_bus_add_devices+0x7e/0x190<br /> enable_slot+0x9b9/0x1130<br /> acpiphp_check_bridge.part.0+0x2e1/0x460<br /> acpiphp_hotplug_notify+0x36c/0x3c0<br /> acpi_device_hotplug+0x203/0xb10<br /> acpi_hotplug_work_fn+0x59/0x80<br /> ...<br /> <br /> Freed by task 41 on cpu 1 at 75.138639s:<br /> kasan_save_stack+0x24/0x50<br /> kasan_save_track+0x17/0x60<br /> kasan_save_free_info+0x3b/0x60<br /> __kasan_slab_free+0x43/0x70<br /> kfree+0x135/0x410<br /> fst_remove_one+0x2ca/0x540<br /> pci_device_remove+0xa6/0x1d0<br /> device_release_driver_internal+0x364/0x530<br /> pci_stop_bus_device+0x105/0x150<br /> pci_stop_and_remove_bus_device+0xd/0x20<br /> disable_slot+0x116/0x260<br /> acpiphp_disable_and_eject_slot+0x4b/0x190<br /> acpiphp_hotplug_notify+0x230/0x3c0<br /> acpi_device_hotplug+0x203/0xb10<br /> acpi_hotplug_work_fn+0x59/0x80<br /> ...<br /> <br /> The buggy address belongs to the object at ffff88800aad1000<br /> which belongs to the cache kmalloc-1k of size 1024<br /> The buggy address is located 28 bytes inside of<br /> freed 1024-byte region<br /> The buggy address belongs to the physical page:<br /> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0<br /> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0<br /> flags: 0x100000000000040(head|node=0|zone=1)<br /> page_type: f5(slab)<br /> raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000<br /> raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000<br /> head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000<br /> head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000<br /> head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff<br /> head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000<br /> page dumped because: kasan: bad access detected<br /> <br /> Memory state around the buggy address:<br /> ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc<br /> ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc<br /> &gt;ffff88800aad1000: fa fb<br /> ---truncated---