CVE-2026-43177

Description

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Fix RPM reference leak in probe error paths Several error paths in ipu6_pci_probe() were jumping directly to out_ipu6_bus_del_devices without releasing the runtime PM reference. Add pm_runtime_put_sync() before cleaning up other resources.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Versions prior to commit 364759ccc3fb49754758c585c530407f96683030)

Linux Kernel (Versions prior to commit 3cd9e7539a3010a83391fecade1186cf30e616c9)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC Concept for CVE-2026-43177
 * This C code snippet demonstrates the logic flaw.
 * Triggering this requires the IPU6 hardware and forcing a probe failure.
 */

#include <linux/module.h>
#include <linux/pm_runtime.h>

void vulnerable_function(struct device *dev) {
    // Acquire RPM reference
    pm_runtime_get_sync(dev);

    // Simulate an error condition in probe
    int error = -1; 
    if (error) {
        // BUG: Jumping to cleanup without pm_runtime_put_sync(dev)
        goto cleanup;
    }

    // Normal operation...
    pm_runtime_put_sync(dev);
    return;

cleanup:
    // Missing pm_runtime_put_sync(dev) here causes the leak
    printk(KERN_ERR "Resource leaked: RPM reference not released\n");
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43177
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43177
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43177/
[4] VulDB https://vuldb.com/cve/CVE-2026-43177
[5] https://git.kernel.org/stable/c/364759ccc3fb49754758c585c530407f96683030
[6] https://git.kernel.org/stable/c/3cd9e7539a3010a83391fecade1186cf30e616c9
[7] https://git.kernel.org/stable/c/6099f78e4c9223f4de4169d2fd1cded01279da1a
[8] https://git.kernel.org/stable/c/fdc06d36dab7b28c2bdd16cb7ee4f25e0f55d9ac

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43177", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:36.190", "lastModified": "2026-05-12T19:54:16.280", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ipu6: Fix RPM reference leak in probe error paths\n\nSeveral error paths in ipu6_pci_probe() were jumping directly to\nout_ipu6_bus_del_devices without releasing the runtime PM reference.\nAdd pm_runtime_put_sync() before cleaning up other resources."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.75", "matchCriteriaId": "CB67FC73-CF7B-41DB-A5A5-423C53BE93EF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/364759ccc3fb49754758c585c530407f96683030", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/3cd9e7539a3010a83391fecade1186cf30e616c9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/6099f78e4c9223f4de4169d2fd1cded01279da1a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/fdc06d36dab7b28c2bdd16cb7ee4f25e0f55d9ac", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}