Security readout for executives and security teams
Plain-English summary
A cleanup race in Linux’s FarSync WAN-card driver can leave background tasks using card data after it is freed. This unsafe memory access can destabilize the kernel. Exposure appears concentrated in systems using FarSync T-series hardware, particularly during device detach or hot-removal; the sources do not establish widespread remote exploitability.
Executive priority
Prioritize prompt remediation on systems using FarSync T-series cards, especially where PCI hot-removal occurs. First confirm hardware and driver presence; broad emergency action across all Linux systems is unsupported by the supplied evidence.
Technical view
fst_remove_one() frees fst_card_info while fst_tx_task or fst_int_task can remain scheduled or running. Their handlers subsequently access the freed object in fst_process_tx_work_q() or fst_process_int_work_q(). KASAN captured a slab use-after-free read in do_bottom_half_tx() during PCI/ACPI removal. Referenced stable-kernel commits resolve the race; branch applicability requires verification.
Likely exposure
Likely limited to Linux hosts with affected kernels and FarSync T-series cards using the FarSync driver. The demonstrated trigger occurs while the card is detached, including PCI/ACPI hot-removal. Systems without this hardware or driver path are unlikely to be exposed. The supplied affected-version data is ambiguous, so verify exact distribution builds against vendor guidance and referenced fixes.
Exploitation context
The bundle marks KEV false and cites no exploitation in the wild or public exploit. It documents a KASAN-detected race during card removal. The supplied CVSS indicates network reachability and required user interaction, but the technical description does not establish how a remote attacker could reliably trigger the detach race.
Researcher notes
The evidence demonstrates a temporal memory-safety failure, not attacker control: cleanup on one CPU races scheduled tasklets on another. KASAN confirms a four-byte read 28 bytes into a freed 1 KiB allocation. No CWE, exploit chain, or demonstrated confidentiality or integrity impact is supplied. The CVSS vector’s AV:N/UI:R characteristics are not explained by the technical narrative.
Mitigation direction
- Apply a distribution or vendor kernel update containing the applicable referenced Linux stable fix.
- Until updated, avoid FarSync T-series detach or hot-removal operations where operationally safe.
- Follow Linux and distribution guidance to identify the correct fixed build for each kernel branch.
Validation and detection
- Inventory Linux systems with FarSync T-series cards and determine whether the FarSync driver is present and active.
- Compare each running kernel package and source revision with distribution guidance and the applicable referenced stable commit.
- Inspect kernel logs and crash reports for KASAN, do_bottom_half_tx, fst_process_tx_work_q, or fst_process_int_work_q indicators.
- Confirm updated kernels include the branch-specific fix before returning normal detach or hot-removal procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43232 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8CVE reference, Linux
- https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79CVE reference, Linux
- https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dcCVE reference, Linux
- https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924CVE reference, Linux
- https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81CVE reference, Linux
- https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2CVE reference, Linux
- https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02eCVE reference, Linux
- https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.