PatchSiren cyber security CVE debrief
CVE-2026-43064 Linux CVE debrief
A workqueue leak in the Linux kernel's Intel Data Streaming Accelerator (DSA)/Intel Analytics Accelerator (IAA) driver (dmaengine/idxd) can lead to resource exhaustion and local denial of service. When an idxd device is released, its associated workqueue is not freed, causing the leaked workqueue to persist. This flaw affects multiple stable kernel branches and 7.0 release candidates. The vulnerability requires local access and low privileges, with no impact to confidentiality or integrity, but high availability impact. Patches have been committed to stable kernel branches.
- Vendor
- Linux
- Product
- Unknown
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-05
- Original CVE updated
- 2026-06-19
- Advisory published
- 2026-05-05
- Advisory updated
- 2026-06-19
Who should care
Organizations running Linux systems with Intel DSA or IAA hardware enabled, particularly those in data-intensive environments where devices may be frequently attached and detached. Cloud providers and HPC operators using affected kernel versions should prioritize patching.
Technical summary
The dmaengine/idxd driver in the Linux kernel fails to release the workqueue associated with a DSA or IAA device when the device object is freed during .release(). This results in a workqueue leak that can exhaust system resources and cause a local denial of service. The flaw exists in multiple kernel stable branches from 5.11.22 through 6.19.x and the 7.0-rc series. The CVSS 3.1 score is 5.5 (MEDIUM) with local attack vector, low privileges required, and high availability impact. Patches have been committed to stable kernel trees.
Defensive priority
medium
Recommended defensive actions
- Apply the relevant stable kernel patch for your branch (5.12.x, 5.13.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, or 7.0-rc) once available through your distribution's security updates.
- Monitor distribution security advisories for kernel packages containing the idxd workqueue fix.
- If running affected kernel versions with DSA/IAA hardware enabled, plan maintenance windows for kernel updates to prevent potential workqueue exhaustion under repeated device attach/detach cycles.
- Review systems for unusual workqueue accumulation or memory pressure symptoms that may indicate exploitation attempts.
Evidence notes
CVE description states workqueue is not released on .release(). NVD CPE data confirms affected Linux kernel versions from 5.11.22 through multiple stable branches and 7.0-rc series. Six patch commits are referenced in NVD metadata. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields score 5.5 (MEDIUM).
Sources and references
Verified primary and authoritative sources
-
CVE-2026-43064 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-43064
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-43064 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43064
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/3d33de353b1ff9023d5ec73b9becf80ea87af695
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/958e96533ddbd1edd127feb7624a7eed0cc379dc
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/d02c24af126dee45247dc7890409c86d1831859d
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/fc34f199eb576b3a73089452fdf0056cc9a9301d
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/fd4cb61bbd0fc3a749a8da6145cbb56d8f6dba35
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.