CVE-2026-43008: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-43008 is a NULL pointer dereference vulnerability in the Linux kernel's gpio: qixis-fpga driver, caused by incorrect error handling for the devm_regmap_init_mmio() function. The function returns an ERR_PTR() on failure rather than NULL, but the original code checked for NULL, meaning errors would never be caught and could lead to an invalid pointer dereference. Affected versions include Linux kernel 6.19 up to (but not including) 6.19.12, as well as Linux kernel 7.0 release candidates (rc1 through rc6). It was published on May 1, 2026, with patches available by May 7, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-253 (Incorrect Check of Function Return Value) and CWE-476 (NULL Pointer Dereference). The devm_regmap_init_mmio() function in the gpio: qixis-fpga driver returns an ERR_PTR() encoded error value on failure — not NULL — but the original driver code performed a NULL check, which would never evaluate to true on error. As a result, the driver would proceed with an invalid (error-encoded) pointer, potentially causing a kernel panic or invalid memory access when the pointer is subsequently dereferenced. The fix replaces the NULL check with the proper IS_ERR() and PTR_ERR() macros to correctly detect and propagate the error (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this vulnerability by a local, low-privileged attacker could result in a kernel panic or system crash, impacting availability. There is no confidentiality or integrity impact identified. The vulnerability is limited in scope to systems running the affected Linux kernel versions with the qixis-fpga GPIO driver loaded, which is typically found on embedded or FPGA-based hardware platforms (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (4th percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory).

The Linux kernel has been patched to correct the error handling in the gpio: qixis-fpga driver using IS_ERR() and PTR_ERR() macros. Patches are available for the 6.19 stable branch (fixed in 6.19.12) and the 7.0 development branch. Administrators should update to Linux kernel 6.19.12 or later, or apply the upstream commits 8de4e0f44c638c66cdc5eeb4d5ab9acd61c31e4f and e54b8fe9454cc786590a0b88db96afe0cdc8a83d. Systems not using FPGA hardware with the qixis-fpga GPIO driver are not affected (GitHub Advisory, Red Hat Bugzilla).