CVE-2026-43203

What it actually does

This is a Linux kernel use-after-free in the ATM FORE Systems PCA-200E/SBA-200E network adapter driver. During device removal, the driver can free the fore200e device structure while transmit or receive tasklets are still pending or executing. If an interrupt schedules one of those tasklets during or after shutdown, the tasklet can dereference memory that has already been released. In kernel context, that can cause a crash, memory corruption, or potentially code execution depending on allocator state, timing, kernel hardening, and attacker control over reclaimed memory.

Why it matters to the business

Systems using the affected Linux kernel driver for FORE200E ATM adapters could be crashed or destabilized during device removal or driver shutdown, creating service outages for workloads that depend on those hosts. The issue is not currently listed in CISA KEV, has low EPSS at 0.00435 with a flat 30-day trend, and has no known public exploit maturity, so broad internet-scale exploitation is unlikely; however, kernel memory corruption vulnerabilities should still be prioritized on exposed, high-availability, or appliance-like systems where an outage has operational impact.

How an attack unfolds

An attacker would need conditions that cause the fore200e driver to handle traffic or interrupts while the adapter is being removed, reset, or the driver is being unloaded. The vulnerable sequence occurs when shutdown frees the fore200e structure before pending tx_tasklet or rx_tasklet work has been fully canceled. If an interrupt schedules a tasklet around the same time, the tasklet later runs and accesses the freed structure in fore200e_tx_tasklet() or fore200e_rx_tasklet(). In the most common outcome, this produces a kernel oops, panic, or host instability. More advanced exploitation would require winning a race and shaping kernel heap reuse so the freed object is replaced with attacker-influenced data, which is significantly harder and depends on kernel configuration and mitigations.

How to fix it

Upgrade to a Linux kernel build that includes the fore200e shutdown fix, which calls tasklet_kill() after fore200e_reset() and before freeing the device structure when the driver has reached the IRQ-initialized state. No exact fixed package versions were provided in the input, so use the fixed kernel versions from the relevant Linux distribution, vendor advisory, or stable kernel branch. If the hardware/driver is not required, disable or remove support for the FORE200E ATM driver, blacklist the module if it is modular, and avoid loading it on production systems. As compensating controls, restrict local ability to unload drivers or remove devices, limit physical/device-management access, and avoid hot-removal or driver reload operations on affected kernels where possible.

How to confirm the fix worked

Confirm that the running kernel package is at or above the vendor-fixed release containing the fore200e tasklet cancellation patch. Check whether the driver is present or loaded using kernel module inventory tools such as lsmod, modinfo, or distribution package manifests, and verify whether CONFIG_ATM_FORE200E is enabled in the kernel configuration. On systems with the hardware, validate that driver unload, device removal, reboot, and network traffic during shutdown no longer produce kernel oops, panic, KASAN, or use-after-free messages involving fore200e tasklet functions. For custom kernels, inspect the source or patch set and verify that fore200e_shutdown() kills the transmit and receive tasklets after reset and before freeing the fore200e object.

Typical attack path

1. Identify a Linux system using the ATM FORE200E driver or hardware support.
2. Create or wait for a condition where the adapter/driver is being removed, reset, shut down, or unloaded.
3. Generate network activity or interrupt conditions that cause fore200e_interrupt() to schedule transmit or receive tasklets.
4. Race the shutdown path so the fore200e structure is freed while a tasklet is still pending or executing.
5. Trigger fore200e_tx_tasklet() or fore200e_rx_tasklet() to dereference the freed structure.
6. Cause kernel memory corruption, a kernel oops/panic, denial of service, or potentially gain further control if heap reuse can be manipulated.

How to detect it

Review kernel logs and crash artifacts for evidence of a race during FORE200E driver shutdown or device removal. Useful sources include dmesg, journald/kern.log, /var/log/messages, /var/log/kern.log, persistent pstore logs, kdump/vmcore output, KASAN reports, and EDR telemetry that captures kernel panics or module load/unload events. Look for oops or panic traces that include fore200e_tx_tasklet(), fore200e_rx_tasklet(), fore200e_interrupt(), fore200e_shutdown(), tasklet execution, or use-after-free diagnostics. Also correlate any crash with recent module unload, PCI device removal, reboot/shutdown, hotplug activity, or network activity on FORE200E ATM interfaces. There are no known public exploit indicators, so detection is primarily crash-forensic and exposure-based rather than signature-based.

• fore200e_tx_tasklet
• fore200e_rx_tasklet
• fore200e_interrupt
• fore200e_shutdown
• fore200e_pca_remove_one
• fore200e_reset
• BUG: KASAN: use-after-free
• use-after-free in fore200e
• general protection fault
• Unable to handle kernel paging request
• kernel BUG at drivers/atm/fore200e
• drivers/atm/fore200e.c
• fore_200e
• /lib/modules/*/kernel/drivers/atm/fore_200e.ko
• CONFIG_ATM_FORE200E

What your security team should do

• Prioritize patching systems that actually include or load the FORE200E ATM driver, especially network appliances, telecom systems, legacy infrastructure, and high-availability hosts.
• If the driver is unused, disable it in kernel configuration or blacklist the module to remove the vulnerable code path.
• Inventory kernels for CONFIG_ATM_FORE200E and the fore_200e/fore200e driver rather than treating all Linux hosts as equally exposed.
• Monitor kernel logs for crashes, KASAN reports, general protection faults, or oops traces referencing fore200e_tx_tasklet(), fore200e_rx_tasklet(), fore200e_interrupt(), or fore200e_shutdown().
• Restrict administrative actions that unload kernel modules or remove devices, because exploitation depends on driver shutdown/removal timing.
• Track distribution advisories for exact fixed kernel package versions and include the fix in regular kernel update baselines.
• Because this issue is not KEV-listed, not associated with ransomware, and has low EPSS, prioritize based on actual driver exposure and business criticality rather than emergency fleet-wide action.