Executive brief
A vulnerability exists in the Linux kernel's FORE200E ATM network adapter driver. When the network hardware is removed or detached from the system, a race condition can occur where the system attempts to access memory that has already been freed. This can lead to system instability, crashes, or potential unauthorized code execution.
Technical details
A use-after-free (UAF) vulnerability exists in the drivers/atm/fore200e.c component of the Linux kernel. The issue stems from a race condition during device detachment (fore200e_pca_remove_one) where the fore200e structure is deallocated while tx_tasklet or rx_tasklet may still be scheduled or running. An attacker could potentially exploit this race condition to trigger a UAF when fore200e_tx_tasklet() or fore200e_rx_tasklet() accesses the freed memory. The fix involves implementing tasklet_kill() within the fore200e_shutdown() sequence to ensure all pending tasklets are synchronized and terminated before the memory is released. This bug was identified via static analysis and affects systems using PCA-200E or SBA-200E adapters.
Affected products
- Linux Linux Kernel versions from 2.6.12.1 up to 5.10.252; 5.11 up to 5.15.202; 5.16 up to 6.1.165; 6.2 up to 6.6.128; 6.7 up to 6.12.75; 6.13 up to 6.18.16; 6.19 up to 6.19.6
Timeline
- 2026-02-10: patched: Initial patch authored by Duoming Zhou
- 2026-05-06: disclosed: CVE published
References
- https://git.kernel.org/stable/c/5189368f10903956be05062d160b2804bf5e5016
- https://git.kernel.org/stable/c/73fbc5d1a9ccb626937500bbd67136f077d8237b
- https://git.kernel.org/stable/c/8930878101cd40063888a68af73b1b0f8b6c79bc
- https://git.kernel.org/stable/c/91f25749aaf57c47ae1e12478144e6ea8c8562f2
- https://git.kernel.org/stable/c/97900f512252a59f23d6ce4ab215cc88fed66e68
- https://git.kernel.org/stable/c/aba0b4bc09376dfc3d53c826514fe38fc8337f52
- https://git.kernel.org/stable/c/e075ec9b08f862dade8011481058f7eb5f716c57