CVE-2026-43200

Vulnerability

Details

In the Linux kernel, the pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() functions were implemented with the parameters in the wrong order when compared to the configfs_item_operations callback signature. The drop_link callback expects struct config_item *src first and struct config_item *target second, but the PCI endpoint functions passed them in reverse order. This mismatch leads to accessing incorrect memory, resulting in a kernel crash as seen in the oops trace [1][4].

Exploitation

An attacker with local access to a system using the PCI endpoint framework and configfs can trigger this bug by issuing an unlink command on a configfs entry that invokes the affected functions. No elevated privileges are required beyond the ability to manipulate configfs entries, which may be available to unprivileged users depending on system configuration. The crash manifests as an "Unable to handle kernel paging request" at virtual address derived from swapped pointers [1][4].

Impact

Successful exploitation causes a denial of service (system crash) due to the kernel panic. The CVSS v3 score of 5.5 (Medium) reflects this local, low-complexity attack vector. There is no indication of privilege escalation or data corruption beyond the immediate crash [1][4].

Mitigation

The fix corrects the parameter order in both unlink functions to match the configfs callback interface. The patch has been applied to the stable kernel tree, and users should update to a kernel containing the fix. No known workarounds exist; the vulnerability is resolved by the kernel patch [1][4].