Skip to main content

Linux Kernel CVE-2026-43177

| EUVDEUVD-2026-27739 MEDIUM
2026-05-06 Linux GHSA-jpc7-m93r-5874
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access required to trigger probe error path; impact is availability-only from PM reference leak with no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:07 vuln.today
CVSS changed
May 12, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: ipu6: Fix RPM reference leak in probe error paths

Several error paths in ipu6_pci_probe() were jumping directly to out_ipu6_bus_del_devices without releasing the runtime PM reference. Add pm_runtime_put_sync() before cleaning up other resources.

AnalysisAI

Runtime PM reference leak in the Linux kernel's Intel IPU6 PCI driver causes a local denial-of-service condition on systems with compatible Intel Image Processing Unit hardware. Low-privileged local users on affected kernel versions can trigger unbalanced runtime power management reference counts when the ipu6_pci_probe() function traverses error paths without calling pm_runtime_put_sync(), leaving the device in a corrupted power management state. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects negligible real-world exploitation interest; no active exploitation has been confirmed.

Technical ContextAI

The vulnerability resides in the ipu6_pci_probe() function within the Linux kernel's media subsystem, specifically the Intel IPU6 (Image Processing Unit 6) driver used on Intel Tiger Lake and Alder Lake platforms. The root cause is a resource management flaw analogous to CWE-772 (Missing Release of Resource after Effective Lifetime): multiple error paths in the probe function jump directly to the out_ipu6_bus_del_devices cleanup label without first invoking pm_runtime_put_sync() to decrement the runtime PM usage count. This leaves the RPM reference counter unbalanced, preventing the kernel's power management subsystem from properly tracking device state and potentially causing hangs or instability during subsequent power transitions. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the full Linux kernel tree; however, impact is hardware-gated to systems where the ipu6 PCI device is present and the driver loads.

RemediationAI

The primary remediation is upgrading to a patched kernel version: 6.12.75, 6.18.16, 6.19.6, or 7.0 depending on the stable branch in use. Fix commits are confirmed upstream at https://git.kernel.org/stable/c/fdc06d36dab7b28c2bdd16cb7ee4f25e0f55d9ac, https://git.kernel.org/stable/c/364759ccc3fb49754758c585c530407f96683030, https://git.kernel.org/stable/c/3cd9e7539a3010a83391fecade1186cf30e616c9, and https://git.kernel.org/stable/c/6099f78e4c9223f4de4169d2fd1cded01279da1a. Red Hat and SUSE users should monitor distribution security channels for backported updates. As a compensating control on servers or systems where Intel IPU6 camera functionality is not required, blacklisting the ipu6 module (adding 'blacklist ipu6' to /etc/modprobe.d/blacklist.conf and rebuilding initramfs) prevents the driver from loading entirely, eliminating the attack surface at the cost of disabling any Intel IPU6-dependent media functionality.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43177 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy