High 7.8Published May 1, 2026

CVE-2026-43007accel/qaic: Handle DBC deactivation if the owner went away

Updated under an hour ago (Oct 26, 2026, 9:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	129776ac2e38231fa9c02ce20e116c99de291666 builds before 2dd67966f39a2abf8ccb4865031c722e40e01b7f; 129776ac2e38231fa9c02ce20e116c99de291666 builds before 08021f2d4a557d6491e3bcc288e96425f50aa3cf; from 129776ac2e38231fa9c02ce20e116c99de291666 before f403094d9075d7c565a3d81002b781c325cb3c07; from 129776ac2e38231fa9c02ce20e116c99de291666 before ee0180e77e6c8482644569632065411de844c515; 129776ac2e38231fa9c02ce20e116c99de291666 builds before 2feec5ae5df785658924ab6bd91280dc3926507c	CNA record
linux linux_kernel linux:linux_kernel	from 6.4 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; 7.0; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/2dd67966f39a2abf8ccb4865031c722e40e01b7f	patch
https://git.kernel.org/stable/c/08021f2d4a557d6491e3bcc288e96425f50aa3cf	patch
https://git.kernel.org/stable/c/f403094d9075d7c565a3d81002b781c325cb3c07	patch
https://git.kernel.org/stable/c/ee0180e77e6c8482644569632065411de844c515	patch
https://git.kernel.org/stable/c/2feec5ae5df785658924ab6bd91280dc3926507c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.