{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-43015", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-43015", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-05-01T14:15:20.242Z", "updatedAt": "2026-05-23T16:05:58.376Z", "importedAt": "2026-10-24T01:58:08.712Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "net: macb: fix clk handling on PCI glue driver removal", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix clk handling on PCI glue driver removal\n\nplatform_device_unregister() may still want to use the registered clks\nduring runtime resume callback.\n\nNote that there is a commit d82d5303c4c5 (\"net: macb: fix use after free\non rmmod\") that addressed the similar problem of clk vs platform device\nunregistration but just moved the bug to another place.\n\nSave the pointers to clks into local variables for reuse after platform\ndevice is unregistered.\n\nBUG: KASAN: use-after-free in clk_prepare+0x5a/0x60\nRead of size 8 at addr ffff888104f85e00 by task modprobe/597\n\nCPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x8d/0xba\n print_report+0x17f/0x496\n kasan_report+0xd9/0x180\n clk_prepare+0x5a/0x60\n macb_runtime_resume+0x13d/0x410 [macb]\n pm_generic_runtime_resume+0x97/0xd0\n __rpm_callback+0xc8/0x4d0\n rpm_callback+0xf6/0x230\n rpm_resume+0xeeb/0x1a70\n __pm_runtime_resume+0xb4/0x170\n bus_remove_device+0x2e3/0x4b0\n device_del+0x5b3/0xdc0\n platform_device_del+0x4e/0x280\n platform_device_unregister+0x11/0x50\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n \n\nAllocated by task 519:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n __kasan_kmalloc+0x8e/0x90\n __clk_register+0x458/0x2890\n clk_hw_register+0x1a/0x60\n __clk_hw_register_fixed_rate+0x255/0x410\n clk_register_fixed_rate+0x3c/0xa0\n macb_probe+0x1d8/0x42e [macb_pci]\n local_pci_probe+0xd7/0x190\n pci_device_probe+0x252/0x600\n really_probe+0x255/0x7f0\n __driver_probe_device+0x1ee/0x330\n driver_probe_device+0x4c/0x1f0\n __driver_attach+0x1df/0x4e0\n bus_for_each_dev+0x15d/0x1f0\n bus_add_driver+0x486/0x5e0\n driver_register+0x23a/0x3d0\n do_one_initcall+0xfd/0x4d0\n do_init_module+0x18b/0x5a0\n load_module+0x5663/0x7950\n __do_sys_finit_module+0x101/0x180\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFreed by task 597:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x2a/0x50\n __kasan_slab_free+0x106/0x180\n __kmem_cache_free+0xbc/0x320\n clk_unregister+0x6de/0x8d0\n macb_remove+0x73/0xc0 [macb_pci]\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "7721221e87d25c9840d9ca6b986dbdc410d5ce2b", "status": "affected", "versionType": "git", "lessThan": "bf64cae913cdd4821f13d5d1d68900c0891bef69" }, { "version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8", "status": "affected", "versionType": "git", "lessThan": "67f70841a175fa3469119f52d77a3662c07507a2" }, { "version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8", "status": "affected", "versionType": "git", "lessThan": "2d96204e4184d6f7dd2f93c6f218fd0c1f55e9ae" }, { "version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8", "status": "affected", "versionType": "git", "lessThan": "b3f799cdf830df1782ae463cf15ace35015be99e" }, { "version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8", "status": "affected", "versionType": "git", "lessThan": "f310a836da90d0f0321b14d446c071af63f9ee4c" }, { "version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8", "status": "affected", "versionType": "git", "lessThan": "16ab4c0e2b15df5d33bfcb9ea8e4441b85dd4a57" }, { "version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8", "status": "affected", "versionType": "git", "lessThan": "3496fb9e66f79d4def3bb7ec7563e3eaa33a688f" }, { "version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8", "status": "affected", "versionType": "git", "lessThan": "ce8fe5287b87e24e225c342f3b0ec04f0b3680fe" }, { "version": "a7d521cc726f30b8e679a6f36d04b18a8ab3c536", "status": "affected", "versionType": "git" }, { "version": "46670fb832ee80943715df618632ca13c2e96f2b", "status": "affected", "versionType": "git" }, { "version": "1da750d1e2140ef43d64d17f301ff6f41b45541e", "status": "affected", "versionType": "git" }, { "version": "4ad6f2d23b0f6ac0d3e5f3102a4256d1c86c90f5", "status": "affected", "versionType": "git" }, { "version": "5.10.70", "status": "affected", "versionType": "semver", "lessThan": "5.10.253" }, { "version": "4.14.249", "status": "affected", "versionType": "semver", "lessThan": "4.15" }, { "version": "4.19.209", "status": "affected", "versionType": "semver", "lessThan": "4.20" }, { "version": "5.4.150", "status": "affected", "versionType": "semver", "lessThan": "5.5" }, { "version": "5.14.9", "status": "affected", "versionType": "semver", "lessThan": "5.15" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "5.15" }, { "version": "5.10.253", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.203", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.168", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.134", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.81", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.22", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "6.19.12", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.19.*" }, { "version": "7.0", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }