CVE-2026-43081

What it actually does

This is a local denial-of-service vulnerability in the Linux kernel IPA networking driver used on platforms with Qualcomm IPA/GSI hardware. Incorrect GENERIC_CMD register field masks for IPA v5.0 and later can cause the driver to program or interpret hardware command fields incorrectly during IPA/GSI operations, including remote processor stop flows such as stopping the modem subsystem while IPA is active. The observed failure mode is a kernel WARN; on systems configured to panic on kernel warnings, or where the bad command state destabilizes the IPA/GSI path, this can result in loss of availability through a kernel panic, device reboot, or networking/modem disruption. The CVSS vector indicates exploitation requires local access and low privileges, with no user interaction and no confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can make affected Linux-based devices or appliances unstable or unavailable, especially systems that rely on Qualcomm IPA-based networking or modem connectivity. The main operational risk is service interruption, device reboot, or loss of network/modem functionality rather than data theft. The vulnerability is not currently listed in CISA KEV, has no known ransomware association, has no public exploit maturity reported, and has a very low EPSS score, so broad internet-scale exploitation is unlikely; however, it is still important for fleets that expose local users, containerized workloads, mobile/edge workloads, or automated services capable of interacting with modem or remote processor control paths.

How an attack unfolds

An attacker first obtains local execution on an affected Linux system with the vulnerable IPA driver and Qualcomm IPA v5.0 or later hardware path present. They then trigger code paths that issue IPA/GSI generic commands while the IPA subsystem is active, such as stopping or restarting the modem/MPSS remote processor or otherwise exercising IPA control operations. Because the kernel driver uses incorrect register field masks, the command encoding does not match the hardware layout, which can cause a kernel warning or broader driver/hardware error state. If the system is configured to treat kernel warnings as fatal, or if the erroneous state disrupts critical IPA/GSI processing, the result can be a kernel panic, reboot, or loss of networking/modem availability. There is no indication from the provided data of remote unauthenticated exploitation or active exploitation by named threat actors.

How to fix it

Apply a Linux kernel update that includes the upstream fix for the IPA GENERIC_CMD register field masks for IPA v5.0 and later. Because no exact fixed package versions were provided, use vendor kernel advisories for the affected distribution, device firmware, Android/mobile BSP, embedded platform, or appliance image to identify the corrected kernel build. Prioritize systems with Qualcomm IPA/GSI hardware and any configuration where kernel warnings can cause panics. If an immediate update is not available, reduce exposure by limiting local shell access, restricting access to remoteproc/modem management interfaces, disabling unnecessary debug or maintenance interfaces that can stop/restart MPSS, and reviewing whether panic_on_warn is appropriate for production availability requirements. Do not rely on network perimeter controls alone, because exploitation is local rather than remote network based.

How to confirm the fix worked

Confirm the running kernel build contains the vendor or upstream patch that corrects IPA v5.0+ GENERIC_CMD field masks. Validate by checking the OS or firmware vendor advisory, package changelog, kernel commit history, or source tree for the IPA GSI generic command mask correction. On Linux systems, record the running kernel with `uname -a` and compare it with the vendor-fixed release. If source or symbols are available, verify the IPA/GSI driver code has updated GENERIC_CMD field definitions matching the documented downstream GSI layout. After patching, test the relevant operational flow in a controlled environment: bring IPA networking up, stop/restart the MPSS or relevant remote processor, and confirm no kernel WARN, panic, reboot, or IPA/GSI error is emitted in `dmesg` or the system journal.

Typical attack path

1. Gain local code execution or an authenticated low-privileged shell on an affected Linux system.
2. Confirm the system uses the vulnerable Linux kernel IPA driver path with Qualcomm IPA/GSI hardware, especially IPA v5.0 or later.
3. Trigger IPA activity so the IPA subsystem is up and processing commands.
4. Invoke or induce a modem/MPSS remoteproc stop, restart, or related IPA/GSI generic command path.
5. Cause the vulnerable driver to use incorrect GENERIC_CMD register field masks.
6. Trigger a kernel WARN, IPA/GSI failure state, kernel panic, reboot, or network/modem service outage.

How to detect it

To determine whether this may already have been triggered, review host kernel logs rather than application logs. Useful sources include `dmesg`, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, persistent `journald` kernel records, crash dumps, pstore/ramoops logs on embedded devices, Android kernel logs if applicable, and appliance firmware diagnostics. Look for kernel warnings or panics involving the IPA driver, GSI generic commands, MPSS/modem remoteproc stop or restart events, and resets that occur while IPA networking is active. Correlate warning timestamps with local user sessions, container activity, device-management commands, modem reset operations, or unexpected reboots. Because the vulnerability produces an availability failure rather than a stable post-exploitation artifact, absence of logs does not fully rule out exploitation, especially if logs are volatile or lost during reboot. There are no known named threat actors, public exploit artifacts, or ransomware campaigns associated with this issue based on the provided data.

• ipa
• GSI
• GENERIC_CMD
• GSI_EE_GENERIC_CMD
• MPSS
• remoteproc
• remoteproc.*stop
• remoteproc.*restart
• kernel: WARNING
• WARNING: CPU:
• panic_on_warn
• Kernel panic
• ipa.*WARN
• gsi.*WARN
• ipa.*GENERIC_CMD
• gsi.*GENERIC_CMD
• MPSS.*stop
• MPSS.*restart

What your security team should do

• Inventory Linux systems, embedded devices, mobile platforms, and appliances that use Qualcomm IPA/GSI hardware or include the Linux kernel IPA driver.
• Prioritize remediation for devices where local users, containers, apps, or management agents can trigger modem/remoteproc restart flows.
• Apply vendor kernel, firmware, BSP, or appliance updates that include the IPA GENERIC_CMD mask fix.
• Search kernel logs for IPA, GSI, MPSS, and remoteproc warnings or panics to identify potentially affected or previously destabilized systems.
• Review `kernel.panic_on_warn` and related crash-on-warning settings where availability is more important than fail-fast behavior.
• Restrict access to local interfaces that can stop, restart, or otherwise control modem/MPSS remote processors until patched.
• Monitor vendor advisories because fixed versions were not provided in the input and may vary by distribution, device vendor, or downstream kernel branch.
• Treat exploitation urgency as moderate: there is high availability impact if triggered, but current EPSS is very low, exploit maturity is none, and the issue is not in CISA KEV.