In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a     QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles     this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling     is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the     deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not     be freed unless the device is removed. If another user loads and requests to activate a network, then the     device assigns the same DBC to that network, QAIC will indefinitely wait for dbc->in_use = false,     leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV     transactions that are received after the user has gone away. (CVE-2026-43007)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333798	Photon OS 5.0: Linux PHSA-2026-5.0-92-0849	Nessus	PhotonOS Local Security Checks	Local	high
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	Local	medium
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	Local	high
311648	Linux Distros Unpatched Vulnerability : CVE-2026-43007	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-43007

high

Tenable Plugins

high

high

medium

high

high