Executive brief
A vulnerability in the Linux kernel's memory handling could allow a local user to cause a system crash. The issue stems from a poorly named and misused internal function that handles data transfers between different parts of the system's memory. If exploited, this could lead to a denial-of-service, impacting the availability of the affected server or workstation.
Technical details
The vulnerability arises from the misleading implementation and naming of the '__copy_user_nocache()' function in the x86-64 architecture of the Linux kernel. This function, intended for non-temporal stores to fragile persistent memory targets, was being misused by various drivers (such as NTB) to perform kernel-to-kernel copies without proper exception handling or user-space access logic (STAC/CLAC). An attacker with local access could potentially trigger improper memory accesses or unhandled exceptions, leading to a kernel panic or system instability. The fix involves renaming the function to 'copy_to_nontemporal', cleaning up its prototype to use proper size_t types, and ensuring callers use the correct memory access logic.
Affected products
- Linux Linux kernel 4.2.1 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-03-30: patched: Initial patch authored by Linus Torvalds
- 2026-05-05: disclosed: CVE-2026-43073 published
References
- https://git.kernel.org/stable/c/14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd
- https://git.kernel.org/stable/c/c6d4e0599e7e73abc04e2488dfeb7940c4039660
- https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe
- https://git.kernel.org/stable/c/d993e1723aa2a085aa0d72e70ea889031fc225b4
- https://git.kernel.org/stable/c/efea91ad1729ff1853d7418e4d3bc27d085e72d0