Linux Kernel CVE-2026-43311

Requires Nvidia Tegra186/194/234 SoC platform running vulnerable Linux kernel with Tegra PMC driver compiled and active (standard configuration for Tegra boards). Attacker must have local authenticated shell access with permissions to trigger system suspend operations via /sys/power/state interface or systemd-logind. Exploitation occurs automatically during normal resume from suspend-to-RAM (S3) power state when PMC wake events are processed. No special kernel boot parameters or non-default configurations required beyond Tegra platform support being enabled at compile time. User interaction not required for exploitation once suspend initiated. Attack limited to specific ARM64 Tegra hardware platforms - does not affect x86, other ARM vendors, or non-Tegra configurations even with same kernel version.

Real-world risk is moderate to low. CVSS 5.5 reflects local access requirement (AV:L), low attack complexity (AC:L), and authenticated attacker (PR:L) causing high availability impact (A:H) through kernel warnings and potential system instability during suspend/resume cycles. However, EPSS score of 0.02% (5th percentile) indicates near-zero observed exploitation probability in the wild, consistent with this being an availability issue rather than memory corruption or privilege escalation. The vulnerability triggers during legitimate system operations (suspend/resume) rather than attacker-controlled code paths, limiting practical exploitability. While CVSS suggests high availability impact, the actual consequence is kernel warning messages and potential resume failures rather than hard crashes or data loss. No CISA KEV listing confirms this is not being actively exploited. Primary risk is to Tegra-based embedded systems requiring reliable suspend/resume functionality (automotive infotainment, industrial controllers). Standard desktop/server Linux deployments are unaffected as they don't use Tegra PMC drivers. Patches available in stable kernel branches reduce urgency. Key missing data: No public POC identified, no reports of exploitation causing actual system failures beyond warning messages.

Local authenticated attacker with standard user privileges on Tegra-based system triggers repeated suspend/resume cycles through systemd, ACPI interface, or direct /sys/power/state writes. Each resume operation invokes tegra186_pmc_wake_syscore_resume which calls generic_handle_irq() from process context, generating kernel warnings and potentially destabilizing IRQ handling subsystem. Repeated exploitation causes kernel log flooding, IRQ descriptor corruption, or resume failures leading to denial of service requiring system reboot.