CVE-2026-43108

Vulnerability

The Linux kernel contains a bug in the Qualcomm pd-mapper (soc: qcom: pd-mapper) component. The element length declared in the servreg_loc_pfr_req_ei structure for the reason field does not match the actual reason field in servreg_loc_pfr_req. This mismatch leads to a QMI decoding error when a protection domain (PD) crash occurs, as evidenced by the kernel log message "qmi_decode_string_elem: String len 81 >= Max Len 65" [1].

Exploitation

This vulnerability is triggered when the pd-mapper processes a servreg_loc_pfr_req message, typically during a PD crash event. An attacker able to induce a PD crash on a Qualcomm SoC device could exploit this to cause the kernel to log a decoding error. The attack surface is limited to local users or processes that can influence PD behavior, as the pd-mapper operates in kernel space and handles QMI communication between subsystems.

Impact

While the bug itself results in a decoding error message, it indicates a broader issue of incorrect element sizing in the QMI message definition. In worst-case scenarios, such mismatches could lead to memory corruption or denial of service if the QMI decoder misinterprets data. The current manifestation is a decoding error, but the root cause is a structural defect that could have more severe consequences under specific conditions.

Mitigation

The fix has been applied in the stable kernel trees, as referenced in the Git commits [1] [2] [3] [4]. Users are advised to update to the latest stable kernel versions that include this patch. No workarounds are documented; the proper mitigation is to apply the kernel update.