Linux Kernel ec_bhf driver CVE-2026-43283

The ec_bhf driver provides Ethernet support for Beckhoff CCAT FPGA devices in the Linux kernel. The vulnerability affects DMA (Direct Memory Access) buffer management specifically in error handling paths. When dma_alloc_coherent() allocates memory, it returns both a virtual address and a physical DMA handle (alloc_phys). The corresponding dma_free_coherent() must receive the correct physical handle to properly unmap the buffer from the IOMMU and release DMA resources. The buggy code incorrectly passes priv->rx_buf.alloc_len (a size value) instead of priv->rx_buf.alloc_phys (the DMA physical address). This creates a type confusion where a length integer is interpreted as a physical memory address, causing the DMA subsystem to attempt unmapping arbitrary or incorrect memory regions. The issue has existed since commit 6af55ff52b02 (kernel 3.15, circa 2014) and affects all subsequent versions until patched. CPE data confirms impact across the entire Linux kernel product line where this driver is compiled.