Junglewise Threat Intelligence

CVE-2026-43200: Linux Kernel denial of service in PCI endpoint unlinking

CVE-2026-43200 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's PCI endpoint subsystem can cause a system crash when managing hardware configurations. By using specific commands to disconnect PCI components via the system's configuration interface, a local user can trigger a kernel failure. This results in a denial-of-service, potentially disrupting operations or causing data loss due to the unexpected system reboot.

Technical details

A parameter ordering bug exists in the pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() functions within drivers/pci/endpoint/pci-ep-cfs.c. The configfs_item_operations callbacks expect 'src' and 'target' parameters, but these functions were implemented with the arguments swapped. When a local attacker with access to configfs attempts to unlink a PCI endpoint function (EPF) from an endpoint controller (EPC), the kernel attempts to process the wrong memory structures, resulting in a null pointer dereference or invalid paging request. This leads to a kernel panic (crash). Patches have been released across multiple stable kernel branches to correct the function signatures.

Affected products

  • Linux Linux Kernel 5.12 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-01-08: other: Patch authored by Manikanta Maddireddy
  • 2026-05-06: disclosed: CVE published by kernel.org
  • 2026-05-06: patched: Fixes merged into stable branches

References