Security readout for executives and security teams
Plain-English summary
A Linux Ethernet driver error path frees DMA memory using a buffer length where a DMA address is required. That can unmap the wrong memory and potentially compromise system confidentiality, integrity, or availability. The issue requires local, low-privileged access according to the supplied CVSS vector and matters primarily where the ec_bhf driver is present.
Executive priority
Treat as a high-priority kernel maintenance issue on systems using ec_bhf, especially multi-user or locally accessible hosts. First establish driver exposure, then apply vendor-confirmed corrected kernels. Broad emergency action across all Linux systems is not supported by the supplied evidence.
Technical view
In the ec_bhf Ethernet driver, an error path calls dma_free_coherent() with priv->rx_buf.alloc_len as the DMA handle instead of priv->rx_buf.alloc_phys. This causes improper DMA buffer unmapping. The supplied CVSS 3.1 assessment is 8.8: local attack vector, low complexity, low privileges, no user interaction, changed scope, and high impacts.
Likely exposure
Exposure is limited to Linux systems containing the affected ec_bhf driver code and reaching its relevant error path. The supplied version data is irregular and includes commit identifiers alongside release numbers, so administrators should verify distribution-specific kernel builds rather than infer exposure solely from version strings.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not listed as KEV. The CVSS vector indicates exploitation requires local, low-privileged access. Public evidence here does not explain the precise trigger, reliability, or whether practical exploitation has been demonstrated.
Researcher notes
The root cause is a type-correct but semantically wrong argument in DMA cleanup: allocation length is supplied as the DMA handle. Evidence confirms the corrected field but does not document triggering conditions, affected hardware, exploit primitives, or practical exploitation. The unusual affected-version representation warrants vendor-branch verification.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable linked stable fix.
- Check Linux distribution advisories for corrected package versions matching each deployed kernel.
- Prioritize systems where untrusted or low-privileged users can obtain local access.
- If updates are unavailable, request vendor-supported mitigations; none are identified in the supplied sources.
Validation and detection
- Inventory Linux kernel versions and determine whether the ec_bhf Ethernet driver is present or loaded.
- Compare deployed kernel source or vendor changelogs with the applicable linked stable fix.
- Confirm dma_free_coherent() receives rx_buf.alloc_phys as the DMA handle in the affected error path.
- Review kernel logs for ec_bhf initialization failures or DMA faults; clean logs do not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43283 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0f589ee54fd6d76d3f75e745f7f12c64cbd749e5CVE reference, Linux
- https://git.kernel.org/stable/c/accd0599bc8e73b962247c6c6c70ca7aa1f8e8d0CVE reference, Linux
- https://git.kernel.org/stable/c/8320727be7ff704e07c87624efc2a4a75f54b3ceCVE reference, Linux
- https://git.kernel.org/stable/c/1e300c33ef3cc544c2b9c693778fe9490cfe9184CVE reference, Linux
- https://git.kernel.org/stable/c/1b1371cd4032ae859838ebc74215f569987bb197CVE reference, Linux
- https://git.kernel.org/stable/c/1b1d3c5d58a80a19d017a409aa2308162bab5bbfCVE reference, Linux
- https://git.kernel.org/stable/c/7e54ff938bebb173822b4c38b33fc164c1cabf92CVE reference, Linux
- https://git.kernel.org/stable/c/ffe68c3766997d82e9ccaf1cdbd47eba269c4aa2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.