PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43064 Linux CVE debrief

A workqueue leak in the Linux kernel's Intel Data Streaming Accelerator (DSA)/Intel Analytics Accelerator (IAA) driver (dmaengine/idxd) can lead to resource exhaustion and local denial of service. When an idxd device is released, its associated workqueue is not freed, causing the leaked workqueue to persist. This flaw affects multiple stable kernel branches and 7.0 release candidates. The vulnerability requires local access and low privileges, with no impact to confidentiality or integrity, but high availability impact. Patches have been committed to stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-06-19
Advisory published
2026-05-05
Advisory updated
2026-06-19

Who should care

Organizations running Linux systems with Intel DSA or IAA hardware enabled, particularly those in data-intensive environments where devices may be frequently attached and detached. Cloud providers and HPC operators using affected kernel versions should prioritize patching.

Technical summary

The dmaengine/idxd driver in the Linux kernel fails to release the workqueue associated with a DSA or IAA device when the device object is freed during .release(). This results in a workqueue leak that can exhaust system resources and cause a local denial of service. The flaw exists in multiple kernel stable branches from 5.11.22 through 6.19.x and the 7.0-rc series. The CVSS 3.1 score is 5.5 (MEDIUM) with local attack vector, low privileges required, and high availability impact. Patches have been committed to stable kernel trees.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant stable kernel patch for your branch (5.12.x, 5.13.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, or 7.0-rc) once available through your distribution's security updates.
  • Monitor distribution security advisories for kernel packages containing the idxd workqueue fix.
  • If running affected kernel versions with DSA/IAA hardware enabled, plan maintenance windows for kernel updates to prevent potential workqueue exhaustion under repeated device attach/detach cycles.
  • Review systems for unusual workqueue accumulation or memory pressure symptoms that may indicate exploitation attempts.

Evidence notes

CVE description states workqueue is not released on .release(). NVD CPE data confirms affected Linux kernel versions from 5.11.22 through multiple stable branches and 7.0-rc series. Six patch commits are referenced in NVD metadata. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields score 5.5 (MEDIUM).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43064 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43064

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43064 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43064

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3d33de353b1ff9023d5ec73b9becf80ea87af695

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/958e96533ddbd1edd127feb7624a7eed0cc379dc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d02c24af126dee45247dc7890409c86d1831859d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fc34f199eb576b3a73089452fdf0056cc9a9301d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fd4cb61bbd0fc3a749a8da6145cbb56d8f6dba35

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.