Skip to main content

Linux Kernel CVE-2026-43138

| EUVDEUVD-2026-27700 HIGH
Use After Free (CWE-416)
2026-05-06 Linux GHSA-3xm2-xcvm-ghrh
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.7 MEDIUM

Triggering via sysfs driver unbind normally requires root, so PR:H; local-only vector (AV:L), low complexity, and a kernel UAF yields high C/I/A.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:09 vuln.today
CVSS changed
May 12, 2026 - 21:22 NVD
7.8 (HIGH)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

reset: gpio: suppress bind attributes in sysfs

This is a special device that's created dynamically and is supposed to stay in memory forever. We also currently don't have a devlink between it and the actual reset consumer. Suppress sysfs bind attributes so that user-space can't unbind the device because - as of now - it will cause a use-after-free splat from any user that puts the reset control handle.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's GPIO-based reset controller driver (reset-gpio) allows a privileged local user to trigger a use-after-free by unbinding the dynamically-created reset device through sysfs while a reset control handle is still held. The reset-gpio device is meant to persist in memory permanently and lacks a devlink to its consumer, so any subsequent access to the dangling reset control handle produces a UAF splat and potential kernel memory corruption. EPSS is very low (0.02%) and there is no public exploit identified at time of analysis; the issue is a defense-in-depth hardening fix rather than a remotely exploitable flaw.

Technical ContextAI

The affected component is the Linux kernel reset subsystem, specifically the GPIO reset controller (drivers/reset/reset-gpio.c). This driver creates a special platform device dynamically to represent a reset line driven by a GPIO. Because it is created on demand and is expected to live for the lifetime of the system, no devlink dependency is established between it and the consumer that holds the reset control handle. The Linux driver model normally exposes 'bind'/'unbind' attributes in sysfs (/sys/bus/platform/drivers/.../unbind) that allow a privileged user to detach a driver from a device at runtime. Unbinding this reset-gpio device frees its backing structures while consumers still reference the reset control, and any later use of that handle dereferences freed memory - the classic CWE-416 Use-After-Free root cause. The fix suppresses the sysfs bind/unbind attributes (DL/DEVICE_ATTR suppression) so user-space cannot detach the device.

RemediationAI

Apply the vendor-released kernel update for your stable series: upgrade to Linux 6.12.75, 6.18.16, 6.19.6, 7.0 or later, which contain the fix that suppresses the reset-gpio sysfs bind/unbind attributes (stable commits 09d6efc6, 76801c3d, 1d7d869f, 16de4c6a at https://git.kernel.org/stable/c/). For distribution kernels, install the corresponding patched package from Red Hat or SUSE once published. As an interim compensating control on systems that cannot immediately reboot, restrict access to sysfs driver-unbind interfaces - ensure only root/trusted administrators can write to /sys/bus/platform/drivers/*/unbind and audit any tooling or udev rules that expose these paths; the trade-off is that legitimate administrative driver rebinding is also blocked, but reset-gpio is never meant to be unbound so this has minimal operational impact. Tracking references: https://nvd.nist.gov/vuln/detail/CVE-2026-43138.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43138 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy