CVE-2026-43143

Vulnerability

CVE-2026-43143 describes a race condition in the Linux kernel's Multi-Function Device (MFD) subsystem. The mfd_of_node_list is a kernel list that tracks device tree nodes for MFD sub-devices. The official description states that manipulating this list without mutual exclusion is unsafe, and a mutex was added to prevent possible crashes [1].

Exploitation

An attacker would need to trigger this race condition by causing concurrent access to the mfd_of_node_list from multiple kernel threads. This could occur during device probing, hotplug events, or other operations that add or remove MFD sub-devices. No special privileges are required beyond the ability to trigger such concurrent operations, which may be possible from user space through device interactions or by exploiting other kernel mechanisms.

Impact

Successful exploitation leads to list corruption, which can cause kernel memory corruption, system crashes (denial of service), or potentially other undefined behavior. The CVSS v3 base score of 5.5 (Medium) reflects the availability impact, but the impact is limited to availability (system crash) and does not include privilege escalation or data confidentiality breaches.

Mitigation

The fix has been applied to the Linux kernel stable tree via commits [1], [2], [3], and [4]. Users should update to a kernel version containing these patches. No workarounds are mentioned in the available references.