Riskcovery

CVE-2026-43007

accel/qaic: Handle DBC deactivation if the owner went away

State
Published
Severity
Not scored
Published
May 1, 2026
Updated
May 11, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/qaic: Handle DBC deactivation if the owner went away

When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang.

As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 129776ac2e38231fa9c02ce20e116c99de291666 to before 2dd67966f39a2abf8ccb4865031c722e40e01b7fAffected
  • 129776ac2e38231fa9c02ce20e116c99de291666 to before 08021f2d4a557d6491e3bcc288e96425f50aa3cfAffected
  • 129776ac2e38231fa9c02ce20e116c99de291666 to before f403094d9075d7c565a3d81002b781c325cb3c07Affected
  • 129776ac2e38231fa9c02ce20e116c99de291666 to before ee0180e77e6c8482644569632065411de844c515Affected
  • 129776ac2e38231fa9c02ce20e116c99de291666 to before 2feec5ae5df785658924ab6bd91280dc3926507cAffected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.6.134 through 6.6.*Not affected
  • 6.12.81 through 6.12.*Not affected
  • 6.18.22 through 6.18.*Not affected
  • 6.19.12 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.