Use-after-free Vulnerability Affecting Linux Kernel PCI Glue Driver

CVE-2026-43015

What is CVE-2026-43015?

A use-after-free vulnerability has been identified in the Linux kernel's PCI glue driver. The issue occurs when the platform_device_unregister() function attempts to utilize registered clocks after the platform device has been unregistered. This situation results in a potential memory access violation, leading to undefined behavior. The vulnerability was initially indicated in the commit d82d5303c4c5, which aimed to tackle similar issues but inadvertently transferred the flaw elsewhere. The mitigation involves preserving clock pointers in local variables for effective reuse after the device unregistration phase, thereby preventing such erroneous memory accesses.

References