LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX. Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion(). At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel error can make Qualcomm IPA networking stop working and cause suspend or processor-shutdown operations to hang indefinitely. The issue affects availability rather than data confidentiality or integrity. Exposure appears limited to systems using IPA v5.0 or later, with observed impact on IPA v5.2.

Executive priority

Treat as a high-priority availability issue for affected mobile, embedded, or communications systems, especially where hangs require intervention or disable networking. Scope hardware first; broad emergency action across unrelated Linux servers is not supported by the supplied evidence.

Technical view

The IPA v5.0 register definition assigns the event-ring index field incorrectly after its move from CH_C_CNTXT_0 to CH_C_CNTXT_1. Consequently, GSI channels may never report transfer completion, leaving gsi_channel_trans_quiesce() blocked in wait_for_completion(). Stable-kernel commits are referenced as fixes.

Likely exposure

Prioritize Linux devices using Qualcomm IPA v5.0+ hardware and affected kernel code. IPA v5.2 is specifically reported. The supplied version metadata is ambiguous, so do not treat every Linux system or every listed version as exposed without checking hardware, kernel provenance, and backports.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation or a working remote attack path. Although the CVSS vector states network reachability, the sources establish an availability failure, not how an unauthenticated network attacker could trigger it.

Researcher notes

The record supplies CVSS 3.1 score 7.5 but no CWE. It describes a register-field naming error and deterministic completion failure. The affected-version list contains unusual entries, including “0” and multiple apparent stable endpoints; validate ancestry and backports against the referenced commits before declaring exposure.

Mitigation direction

  • Install the applicable vendor kernel update containing the referenced stable fix.
  • Confirm distribution backports because package versions may not match upstream version numbers.
  • If updates are unavailable, request product-specific mitigation guidance from the device or kernel vendor.
  • Prioritize systems where IPA failures could disrupt critical communications or power-management operations.

Validation and detection

  • Inventory kernel builds and identify devices using IPA v5.0 or later.
  • Check kernel source or vendor advisories for an applicable referenced fix commit.
  • Test IPA data transfer completion after updating.
  • Exercise runtime suspend, system suspend, and remoteproc stop under controlled conditions.
  • Monitor for indefinite waits involving gsi_channel_trans_quiesce() or wait_for_completion().
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43345 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-43345Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfaf0678ec8a0aa9039d8b188d012206abd67dd5c, faf0678ec8a0aa9039d8b188d012206abd67dd5c, faf0678ec8a0aa9039d8b188d012206abd67dd5c, faf0678ec8a0aa9039d8b188d012206abd67dd5c, faf0678ec8a0aa9039d8b188d012206abd67dd5cunaffected
LinuxLinux6.4, 0, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.