Linux Kernel CVE-2026-43485

Exploitation requires a local user account (CVSS PR:L confirmed) on a system meeting three conditions: the Linux kernel version must fall within the affected range (post-commit 176fdcbddfd2, pre-patch versions 6.18.19, 6.19.9, or 7.0); an NVIDIA GPU must be present and managed by the nouveau open-source driver rather than the proprietary NVIDIA driver; and ACPI support must be active (the default on virtually all x86/x86_64 systems). The high availability impact (A:H) is conditional on panic_on_warn=1 being set in kernel boot parameters - without this setting, impact degrades to log flooding and potential driver instability rather than full denial of service. Remote exploitation is not possible (AV:L). No network exposure, no special user permissions beyond a standard local session, and no specific application or configuration beyond the above hardware/driver prerequisites are required.

The NVD CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 5.5, reflecting local, low-privilege exploitation with high availability impact. The EPSS score of 0.02% (4th percentile) places this firmly in the bottom tier of exploitation likelihood, and it is absent from CISA KEV with no public exploit code identified. One notable data inconsistency: the intelligence tags this CVE as 'Information Disclosure', but the CVSS vector assigns C:N (no confidentiality impact); the only plausible information disclosure vector would be kernel addresses in WARN_ON stack traces partially leaking KASLR, a marginal and well-understood concern not sufficient to override C:N. Real-world risk is bifurcated: on default kernel configurations the impact is limited to log flooding and potential GPU driver instability, making this a low operational priority; on systems with panic_on_warn=1 (common in hardened production, ChromeOS, or kernel CI environments) the risk escalates to denial of service via kernel panic for any local user running NVIDIA GPU workloads. The overall real-world security priority is LOW - this is primarily a kernel quality and stability fix rather than an exploitable security vulnerability.

On an unpatched kernel with an NVIDIA GPU, normal user-space workloads - running a GPU-accelerated application, a desktop environment, or a compute job - exercise the nouveau/gsp ACPI probe path and trigger the WARN_ON assertions. On a default configuration, the kernel emits repeated warning stack traces to dmesg, degrading log visibility and potentially impacting GPU driver stability. On a system with panic_on_warn=1 enabled, a local user with minimal privileges running any such GPU workload can reproducibly cause a kernel panic and system reboot without any specialized exploit code.