Linux Kernel CVE-2026-43073

Exploitation requires local access to the target system with at least low-privilege user credentials (CVSS PR:L confirmed). The NTB (Non-Transparent Bridge) kernel driver or another affected driver must be loaded and accessible - the NTB driver is the explicitly named misuser in the patch description and is not loaded by default on most general-purpose Linux systems; it is specific to PCIe NTB hardware environments. No user interaction is required once the driver is loaded (UI:N). Exploitation is limited to x86-64 architecture, as STAC/CLAC are x86-specific SMAP instructions. The transient nature of the SMAP-disable window makes reliable exploitation difficult and likely requires either precise timing or the ability to induce memory faults during that window. Systems without NTB hardware or without the ntb kernel module loaded are not exposed to the primary identified attack path, though other drivers using the same misused function may extend the surface.

Real-world risk is low-to-moderate despite the CVSS availability-high score. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local exploitation requiring only low privileges with no user interaction - a realistic threat on shared or multi-tenant Linux systems (containers, VMs, hosting environments). However, EPSS at 0.02% (5th percentile) signals extremely low probability of observed exploitation, and there is no CISA KEV listing. The 'Information Disclosure' tag applied by ENISA conflicts with the CVSS C:N rating; this discrepancy should be verified - the SMAP-disable window theoretically creates a transient information-disclosure exposure, but CVSS does not score it as such, and no specific data leakage mechanism is described. The primary practical risk is a locally-triggered kernel panic via the NTB driver or other misusing drivers, which constitutes a local denial of service. On systems where the NTB (Non-Transparent Bridge) driver is loaded, the attack surface is more concrete. No public exploit code exists, and exploitation would require familiarity with kernel driver internals, placing this firmly in the targeted/advanced category if abused.

A local user on a system with the NTB driver loaded triggers a memory copy operation through the driver interface, causing the kernel to invoke __copy_user_nocache() with STAC/CLAC for a kernel-to-kernel copy. If a memory fault or MCE occurs during the brief SMAP-disabled window, the kernel's exception handling misidentifies the fault context, fails to recover gracefully, and issues a kernel panic - crashing the system and causing a denial of service for all users. No public proof-of-concept code exists for this scenario at time of analysis.