CVE-2026-43007

accel/qaic: Handle DBC deactivation if the owner went away

published May 1, 2026

CVSS
—
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

accel/qaic: Handle DBC deactivation if the owner went away

When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV

transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles

this by calling decode_deactivate() to release the resources allocated for

that DBC. Since that handling is done in the qaic_manage_ioctl() context,

if the user goes away before receiving and handling the deactivation, the

host will be out-of-sync with the DBCs available for use, and the DBC

resources will not be freed unless the device is removed. If another user

loads and requests to activate a network, then the device assigns the same

DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,

leading the user process to hang.

As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions

that are received after the user has gone away.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.7th percentile
Published
2026-05-01T14:15Z
EPSS history
Timeline
  • 01 MAY 14:15Z
    accel/qaic: Handle DBC deactivation if the owner went away
    cvelistv5