CVE-2026-43014

Vulnerability

Description

CVE-2026-43014 is a memory leak vulnerability in the Linux kernel's macb (Cadence MACB/GEM) Ethernet driver. The issue arises because the driver allocates resources using clk_register_fixed_rate() but fails to release them with clk_unregister_fixed_rate() during cleanup or removal. This oversight causes the allocated clock resources to be lost, resulting in a memory leak [1].

Exploitation and

Impact

The vulnerability is triggered during normal driver lifecycle operations, such as module removal or device unbinding, when the driver's cleanup path does not properly unregister the fixed-rate clocks. An attacker with local access and the ability to trigger these operations (e.g., by unloading the network driver module) could repeatedly cause memory leaks. Over time, this could exhaust system memory, leading to denial of service (DoS) conditions. The CVSS v3 score of 5.5 (Medium) reflects the need for local access and the potential for availability impact [2].

Mitigation

The fix involves adding calls to clk_unregister_fixed_rate_unregister() in the appropriate cleanup paths of the macb driver. Patches have been applied to the Linux kernel stable branches, as referenced in the commit history [3][4]. Users are advised to update their kernel to a version containing the fix or apply the relevant patch to prevent resource exhaustion.