Medium 5.5Published May 6, 2026

CVE-2026-43149net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()

Updated under an hour ago (Oct 27, 2026, 10:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() The priv->rx_buffer and priv->tx_buffer are alloc'd together as contiguous buffers in uhdlc_init() but freed as two buffers in uhdlc_memclean(). Change the cleanup to only call dma_free_coherent() once on the whole buffer.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c19b6d246a35627c3a69b2fa6bdece212b48214b before 6496fb830cbb741d831225cc4e7e5601c6e42970; from c19b6d246a35627c3a69b2fa6bdece212b48214b before ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4; from c19b6d246a35627c3a69b2fa6bdece212b48214b before 011ae5dd84dc9f05eb9b8e1adff44252ac776e7b; from c19b6d246a35627c3a69b2fa6bdece212b48214b before 0f85a9655445e67bb0238cfc983d7c383b54938e; from c19b6d246a35627c3a69b2fa6bdece212b48214b before 84b932bc9899d43e5829e6cf088b72d73a922b2b; from c19b6d246a35627c3a69b2fa6bdece212b48214b before d8a522085d09b30aba1016daf1dddac37c0f0285; from c19b6d246a35627c3a69b2fa6bdece212b48214b before d68994e37ac3b285692559776e0279a88a3b5f8d; from c19b6d246a35627c3a69b2fa6bdece212b48214b before 36bd7d5deef936c4e1e3cd341598140e5c14c1d3	CNA record
linux linux_kernel linux:linux_kernel	from 4.8 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/6496fb830cbb741d831225cc4e7e5601c6e42970	patch
https://git.kernel.org/stable/c/ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4	patch
https://git.kernel.org/stable/c/011ae5dd84dc9f05eb9b8e1adff44252ac776e7b	patch
https://git.kernel.org/stable/c/0f85a9655445e67bb0238cfc983d7c383b54938e	patch
https://git.kernel.org/stable/c/84b932bc9899d43e5829e6cf088b72d73a922b2b	patch
https://git.kernel.org/stable/c/d8a522085d09b30aba1016daf1dddac37c0f0285	patch
https://git.kernel.org/stable/c/d68994e37ac3b285692559776e0279a88a3b5f8d	patch
https://git.kernel.org/stable/c/36bd7d5deef936c4e1e3cd341598140e5c14c1d3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.