CVE-2026-43203

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

atm: fore200e: fix use-after-free in tasklets during device removal

When the PCA-200E or SBA-200E adapter is being detached, the fore200e

is deallocated. However, the tx_tasklet or rx_tasklet may still be running

or pending, leading to use-after-free bug when the already freed fore200e

is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().

One of the race conditions can occur as follows:

CPU 0 (cleanup) | CPU 1 (tasklet)

fore200e_pca_remove_one() | fore200e_interrupt()

fore200e_shutdown() | tasklet_schedule()

kfree(fore200e) | fore200e_tx_tasklet()

| fore200e-> // UAF

Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before

the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to

synchronize with any pending or running tasklets. Moreover, since

fore200e_reset() could prevent further interrupts or data transfers,

th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References