CVE-2026-43015: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43015 is a use-after-free vulnerability in the Linux kernel's macb (Cadence MAC) network driver, specifically in the PCI glue driver removal path. It affects multiple Linux kernel stable branches, including versions 5.10.70–5.10.253, 5.15.1–5.15.203, 5.16–6.1.168, 6.2–6.6.134, 6.7–6.12.81, 6.13–6.18.22, and 6.19–6.19.12. The vulnerability was published on May 1, 2026, with patches released by May 7, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416 / CWE-825) in the macb_pci driver's removal sequence. When platform_device_unregister() is called during module removal (rmmod), the runtime PM subsystem may still invoke macb_runtime_resume(), which calls clk_prepare() on clock pointers that have already been freed by macb_remove() via clk_unregister(). A prior fix (commit d82d5303c4c5, "net: macb: fix use after free on rmmod") addressed a similar issue but inadvertently relocated the bug. The fix involves saving clock pointers to local variables before platform_device_unregister() is called, ensuring they remain valid throughout the device teardown sequence. KASAN detects the violation as a read of freed memory at clk_prepare+0x5a/0x60 (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel panic or system crash, resulting in a denial of service. An attacker with local access and the ability to load/unload the macb_pci kernel module can trigger the use-after-free by executing rmmod on the module, crashing the affected system. While the CVSS score also reflects high confidentiality and integrity impact (consistent with kernel-level memory corruption primitives), the primary observed impact is availability loss through kernel instability (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (sufficient to execute rmmod) and is only triggerable on systems where the macb_pci driver is compiled as a loadable module. The EPSS score is approximately 0.024% (very low probability of exploitation in the next 30 days). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 with a call trace involving macb_runtime_resume, pm_generic_runtime_resume, platform_device_unregister, and pci_device_remove.
• Process: Unexpected kernel panic or system crash immediately following execution of rmmod macb or rmmod macb_pci.
• Logs: Kernel oops or panic messages referencing macb module and PID associated with modprobe or rmmod commands.

Apply the upstream kernel patches available for all affected stable branches via the kernel stable tree (commits 16ab4c0e, 2d96204e, 3496fb9e, 67f70841, b3f799cd, bf64cae9, ce8fe528, f310a836). Fixed versions include kernel 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, and 6.19.12. As a workaround on unpatched systems, avoid unloading the macb_pci module, or blacklist it if the hardware is not required. Monitor for unexpected kernel crashes following module unload operations (Github Advisory, Red Hat Bugzilla).