CVE-2026-43149

What it actually does

This is a Linux kernel memory-management flaw in the Freescale UCC HDLC WAN driver. The driver allocates receive and transmit DMA buffers as one contiguous coherent DMA allocation, but the cleanup path frees them as if they were two separate allocations. When that cleanup path is reached, the kernel may perform an invalid or duplicate DMA free operation, causing memory corruption or a kernel crash. The practical security impact is local denial of service: a local user with sufficient privileges to load, configure, remove, or otherwise exercise the affected driver path may be able to crash the system. The CVSS vector indicates local access, low attack complexity, required low privileges, no user interaction, and high availability impact, with no expected confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can cause affected Linux systems to crash or become unavailable, which may interrupt network services, embedded networking equipment, industrial systems, or appliances that rely on the affected WAN driver. The issue is lower urgency than remotely exploitable kernel flaws because exploitation requires local access and privileges, EPSS is very low, it is not in CISA KEV, and there is no known public exploit maturity. However, organizations using Linux on hardware that includes the Freescale UCC HDLC driver should still remediate through normal kernel maintenance because kernel crashes can create operational outages and may be difficult to distinguish from hardware or driver instability.

How an attack unfolds

An attacker first needs local access to a system running a vulnerable Linux kernel and enough privileges to interact with the affected WAN driver, such as loading or unloading the module, configuring the associated network interface, or triggering the driver's initialization and cleanup routines. The attacker then causes the driver to allocate its combined RX and TX coherent DMA buffer and later forces an error path or teardown path that calls the vulnerable cleanup routine. Because the cleanup routine frees portions of the combined allocation incorrectly, the kernel DMA allocator can be invoked with inconsistent allocation metadata. This can corrupt kernel memory-management state or trigger a kernel BUG, oops, or panic, resulting in a denial-of-service condition. There is no current indication from the provided intelligence that this vulnerability is being used in ransomware campaigns or by named threat actors.

How to fix it

Update to a Linux kernel build that includes the upstream fix for the Freescale UCC HDLC driver cleanup routine, which changes the cleanup logic to free the combined coherent DMA allocation only once. Because no exact fixed package versions were provided, use the fixed kernel versions published by the relevant Linux distribution, vendor, appliance provider, or kernel maintainers. If immediate patching is not possible, mitigate by disabling or blacklisting the fsl_ucc_hdlc driver where it is not required, preventing untrusted users from loading kernel modules or managing network devices, restricting CAP_SYS_MODULE and CAP_NET_ADMIN, and limiting shell access on systems using affected hardware. Systems that do not include, load, or use the Freescale UCC HDLC WAN driver are unlikely to be practically exposed.

How to confirm the fix worked

Confirm remediation by checking that the running kernel package is at or above the vendor-fixed release containing the fsl_ucc_hdlc DMA cleanup patch. Verify the affected driver is either updated or not present/loaded. On Linux systems, review kernel package changelogs or vendor advisories for references to the fsl_ucc_hdlc, uhdlc_memclean, or dma_free_coherent fix. Check loaded modules with standard module inventory tooling and confirm whether the Freescale UCC HDLC driver is in use. If mitigation is chosen instead of patching, validate that module loading is restricted, the driver is blacklisted or unavailable, and no dependent network interface requires it. Reboot into the patched kernel where required, since installing a kernel package alone does not protect systems still running an older kernel.

Typical attack path

1. Gain local access to a vulnerable Linux system.
2. Obtain sufficient privileges to manage kernel modules, network interfaces, or the affected WAN driver path.
3. Ensure the Freescale UCC HDLC driver is present and reachable on the target system.
4. Trigger driver initialization so the combined RX/TX coherent DMA buffer is allocated.
5. Trigger driver cleanup, unload, reconfiguration, or an error path that invokes the faulty memory cleanup routine.
6. Cause invalid DMA free behavior, leading to kernel memory corruption, oops, panic, or system crash.

How to detect it

There are no strong public, vulnerability-specific indicators of exploitation from the provided intelligence. Detection should focus on evidence that the affected driver was present and that a local user or process triggered driver teardown or error paths followed by a kernel crash. Review kernel logs, system journals, crash dumps, kdump/vmcore data, module load/unload history, audit logs, sudo logs, and command histories for activity involving fsl_ucc_hdlc or related WAN interface configuration. Look for kernel oops, BUG, panic, slab/DMA allocator warnings, or general-protection faults near uhdlc_memclean, dma_free_coherent, fsl_ucc_hdlc, or WAN driver cleanup. Correlate these events with local privileged actions such as modprobe, rmmod, ip link operations, network service restarts, driver reloads, or interface reconfiguration. Absence of these artifacts does not prove absence of attempted exploitation because a crash may truncate logs unless persistent journaling, remote logging, or crash dump capture is enabled.

• fsl_ucc_hdlc
• uhdlc_memclean
• dma_free_coherent
• ucc_hdlc
• /lib/modules/*/kernel/drivers/net/wan/fsl_ucc_hdlc.ko
• modprobe fsl_ucc_hdlc
• rmmod fsl_ucc_hdlc
• kernel BUG
• Oops:
• Kernel panic - not syncing
• Unable to handle kernel paging request
• general protection fault
• DMA-API

What your security team should do

• Inventory Linux systems and appliances that include or load the Freescale UCC HDLC WAN driver, prioritizing embedded, telecom, WAN, and PowerQUICC/Freescale-based platforms.
• Apply vendor kernel updates that contain the upstream fix; reboot systems into the fixed kernel where necessary.
• If the driver is not required, disable or blacklist fsl_ucc_hdlc to remove the reachable attack surface.
• Restrict local administrative capabilities that allow kernel module loading, driver reconfiguration, or network device administration, especially CAP_SYS_MODULE and CAP_NET_ADMIN.
• Monitor kernel logs for crashes, oopses, or panics referencing fsl_ucc_hdlc, uhdlc_memclean, DMA coherent memory, or network driver teardown.
• Treat unexplained kernel crashes on systems using this driver as potentially security-relevant until patched and reviewed.
• Because EPSS is very low, the issue is not in KEV, and no exploit maturity is reported, handle through standard kernel patch cycles unless the affected driver is used on high-availability systems.