CVE-2026-43149

Vulnerability

In the Linux kernel's fsl_ucc_hdlc driver, a memory management error exists in the uhdlc cleanup function uhdlc_memclean(). The driver allocates priv->rx and tx DMA buffers as a single contiguous region in uhdlc_init(), but the cleanup code incorrectly calls dma_free_coherent() twice, treating them as separate allocations [1]. This mismatch can lead to double-free or use-after-free conditions.

Exploitation

An attacker would need local access to the system and the ability to trigger the cleanup path, for example by unloading the ucc_hdlc module or through device removal. No special privileges beyond local user access are required, as the bug is in kernel code reachable from user space via module operations. The attack surface is limited to systems using the Freescale QUICC Engine UCC HDLC driver.

Impact

Successful exploitation could cause memory corruption, leading to a system crash (denial of service) or potentially arbitrary code execution in kernel context. The CVSS v3 score of 5.5 (Medium) reflects the need for local access and the possibility of high impact on availability and integrity.

Mitigation

The fix has been applied to the Linux kernel stable tree [1][2][3][4]. Users should update to a kernel version containing the commit that corrects the dma_free_coherent() call to free the entire buffer once. No workaround is available; updating the kernel is the recommended action.