Junglewise Threat Intelligence

CVE-2026-43148: Linux Kernel NULL pointer dereference in powerpc/smp parse_thread_groups

CVE-2026-43148 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's PowerPC architecture support could allow a local user to cause a system crash. The issue occurs when the system fails to properly handle memory allocation failures during the processing of processor thread groups. This could lead to a denial-of-service condition, impacting the availability of affected servers or workstations.

Technical details

A NULL pointer dereference vulnerability exists in arch/powerpc/kernel/smp.c within the parse_thread_groups() function. The vulnerability is caused by a missing check for the return value of kcalloc() when allocating memory for the thread_group_array. If memory allocation fails, the resulting NULL pointer is passed to of_property_read_u32_array(), leading to a kernel panic. This issue specifically affects PowerPC systems parsing 'ibm,thread-groups' device tree properties. An attacker with local access could potentially trigger this condition to cause a Denial of Service (DoS). Patches have been released across multiple stable kernel branches to ensure the kcalloc() return value is validated before use.

Affected products

  • Linux Linux Kernel 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: advisory: CVE-2026-43148 published by kernel.org
  • 2026-05-13: other: NIST analysis and CVSS score added

References

Related threats