Skip to main content

Linux Kernel CVE-2026-43004

| EUVDEUVD-2026-26603 MEDIUM
2026-05-01 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to trigger PM failure during driver removal; only availability is impacted via resource exhaustion, no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:15 vuln.today
CVSS changed
May 12, 2026 - 18:07 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26603
CVE Published
May 01, 2026 - 14:15 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

spi: stm32-ospi: Fix resource leak in remove() callback

The remove() callback returned early if pm_runtime_resume_and_get() failed, skipping the cleanup of spi controller and other resources.

Remove the early return so cleanup completes regardless of PM resume result.

AnalysisAI

Incomplete cleanup in the Linux kernel STM32 OSPI SPI driver exposes local low-privileged users to availability impact on STM32-based systems. The spi-stm32-ospi driver's remove() callback exits prematurely when pm_runtime_resume_and_get() fails, skipping deallocation of the SPI controller and associated resources, which can cause resource exhaustion and system instability upon device unbind or driver removal. No public exploit exists and EPSS at 0.02% (4th percentile) reflects extremely low exploitation probability; this is a narrow-impact issue constrained to embedded hardware running STM32 OSPI peripherals.

Technical ContextAI

The affected component is the spi-stm32-ospi kernel driver, which manages the OctoSPI (OSPI) peripheral found on STMicroelectronics STM32 SoCs within the Linux kernel SPI subsystem. The root cause is an incomplete cleanup path: when the Power Management runtime call pm_runtime_resume_and_get() returns an error during device removal, the remove() callback returns early rather than proceeding with SPI controller teardown and resource release. Although NVD lists CWE as N/A, this maps to CWE-459 (Incomplete Cleanup) or CWE-772 (Missing Release of Resource after Effective Lifetime). The vulnerability was introduced at commit 79b8a705e26c08f8f09dd55f1dd56f2375973d2d and affects all kernel versions that include that commit but predate the fix commits. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary remediation is to upgrade to a patched kernel release: Linux 6.18.22, 6.19.12, or 7.0, which contain the upstream fixes at commits b4ec54c974c6ea68b309989dcc3d3511068f45f3, 0807532c5ebb72751bfe773e6ae79db0e9c57ab9, and 73cd1f97946ae3796544448ff12c07f399bb2881 (https://git.kernel.org/stable/c/b4ec54c974c6ea68b309989dcc3d3511068f45f3, https://git.kernel.org/stable/c/0807532c5ebb72751bfe773e6ae79db0e9c57ab9, https://git.kernel.org/stable/c/73cd1f97946ae3796544448ff12c07f399bb2881). Red Hat and SUSE are tagged distributors and may provide backported patches via their security channels. As a compensating control for systems that cannot upgrade immediately, blacklisting the spi-stm32-ospi module via /etc/modprobe.d/ eliminates the attack surface entirely, though this disables OSPI peripheral functionality on STM32 hardware. No generic workaround exists that preserves full driver operation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43004 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy