Linux Kernel CVE-2026-43203

Primary remediation is upgrading to patched kernel versions: 5.10.252+ for 5.10.x series, 5.15.202+ for 5.15.x, 6.1.165+ for 6.1.x LTS, 6.6.128+ for 6.6.x, 6.12.75+ for 6.12.x, 6.18.16+ for 6.18.x, 6.19.6+ for 6.19.x, or 7.0+ for mainline. Patches available from kernel.org stable tree (see references at https://git.kernel.org/stable/c/aba0b4bc09376dfc3d53c826514fe38fc8337f52 and related commits). The fix adds tasklet_kill() calls in fore200e_shutdown() after fore200e_reset() within the FORE200E_STATE_IRQ state branch to ensure tasklets complete before memory deallocation. For systems unable to immediately patch, compensating controls include: (1) Blacklist the fore200e kernel module (add 'blacklist fore200e' to /etc/modprobe.d/blacklist.conf) if ATM hardware is unused - eliminates attack surface entirely with no performance impact. (2) Disable hotplug of PCI ATM adapters via udev rules to prevent removal-triggered race condition - limits operational flexibility for hardware maintenance. (3) Restrict CAP_SYS_MODULE capability to prevent unauthorized module unloading - applies defense-in-depth but doesn't prevent race during legitimate removals. Priority should be given to patching over workarounds as this is a kernel-level memory safety issue. Verify patch application by checking kernel version (uname -r) matches patched release and reviewing dmesg during device operations for absence of use-after-free warnings.