Skip to main content

Linux Kernel CVE-2026-43487

| EUVDEUVD-2026-30023 MEDIUM
2026-05-13 Linux GHSA-6v94-wv84-hjg5
Linux Barracuda Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local physical drive presence required; no confidentiality or integrity impact; high availability loss via spontaneous unrecoverable system freeze with no external trigger.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 26, 2026 - 21:55 vuln.today
CVSS changed
Jun 26, 2026 - 19:37 NVD
5.5 (MEDIUM)
Patch available
May 13, 2026 - 16:33 EUVD
CVE Published
May 13, 2026 - 15:08 nvd
MEDIUM 5.5
CVE Published
May 13, 2026 - 15:08 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: Disable LPM on ST1000DM010-2EP102

According to a user report, the ST1000DM010-2EP102 has problems with LPM, causing random system freezes. The drive belongs to the same BarraCuda family as the ST2000DM008-2FR102 which has the same issue.

AnalysisAI

Random system freeze vulnerability in the Linux kernel's libata-core subsystem affects any Linux host physically equipped with a Seagate ST1000DM010-2EP102 BarraCuda hard drive, where the kernel's default enablement of SATA Link Power Management (LPM) causes the drive to fail its wake sequence and hang the system irrecoverably. The ST1000DM010-2EP102 belongs to the same BarraCuda family as the ST2000DM008-2FR102, for which an LPM quirk already exists in libata - the fix extends that quirk to cover this model. No active exploitation has been identified (absent from CISA KEV), and EPSS at 0.02% reflects negligible adversarial interest, consistent with this being a hardware compatibility defect rather than a traditional security flaw.

Technical ContextAI

The Linux kernel's libata-core subsystem manages SATA drive communication and AHCI-level Link Power Management (LPM), which allows drives to enter low-power states (HIPM, DIPM, DevSlp) to reduce energy consumption. When a drive's firmware does not correctly handle LPM wake transitions, libata times out waiting for the drive to respond, which can cascade into a full system freeze. The ST1000DM010-2EP102 (CPE: cpe:2.3:a:linux:linux:*) exhibits exactly this defect - its LPM wake behavior is broken, consistent with the already-known ST2000DM008-2FR102 quirk. The kernel maintains a quirk table in libata-core that explicitly disables LPM for drives with this defect; the vulnerability exists because the ST1000DM010-2EP102 entry was absent from that table. No CWE is formally assigned; the root cause is a missing device compatibility entry, not a memory corruption or logic flaw in the traditional sense.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.12.78 or later in the 6.12.x series, 6.18.19 or later in the 6.18.x series, 6.19.9 or later in the 6.19.x series, or any 7.0+ release, as confirmed by EUVD-2026-30023. Distribution maintainers (Debian, Ubuntu, RHEL, SUSE, Arch) should be monitored for backport availability to their respective kernel packages. As an immediate compensating control prior to kernel upgrade, administrators can disable LPM for the affected drive by appending libata.force=nolpm to kernel boot parameters in GRUB or equivalent, which prevents LPM from being activated at all; note this increases drive power consumption and may affect thermals in compact enclosures. Alternatively, write max_performance to /sys/class/scsi_host/hostN/link_power_management_policy for the relevant AHCI host controller at runtime, though this setting does not persist across reboots without an init script or udev rule.

More in Barracuda

View all
CVE-2017-6320 HIGH POC
8.8 Jul 18

A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (20
CVE-2023-7102 CRITICAL POC
9.8 Dec 24

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Rated critical severity (CVSS 9.8), thi
CVE-2023-2868 CRITICAL POC
9.8 May 24

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) pro
CVE-2019-6724 HIGH POC
7.8 Mar 21

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a

CVE-2023-26213 HIGH POC
7.2 Mar 03

On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injectio
CVE-2018-20369 MEDIUM POC
6.1 Dec 23

Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi
CVE-2014-8428 CRITICAL
9.8 Aug 28

Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key.

CVE-2014-8426 CRITICAL
9.8 Aug 28

Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2021-42711 HIGH
7.8 Dec 01

Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. Rated hi
CVE-2015-0962 MEDIUM
4.3 May 25

Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Auth
CVE-2015-0961 MEDIUM
4.3 May 25

Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-43487 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy