CVE-2026-43073 Linux CVE debrief

Who should care

Linux kernel maintainers, distro security teams, and operators running x86-64 kernels that include drivers or subsystems using this helper, especially NTB or persistent-memory related code. Kernel developers who call the helper directly should also review their usage.

Technical summary

The affected helper, __copy_user_nocache(), was described in the kernel commit message as a misnamed memory-copy routine. It uses non-temporal stores on the destination side, supports exception handling on both source and destination accesses, and is not inherently a user-copy routine. The fix renames the function to a more accurate name, changes the prototype so callers pass a normal size_t and do not rely on an implicit user-pointer interface, and updates NTB code that had been using the user-copy version with STAC/CLAC despite not needing user-space access semantics.

Defensive priority

Medium for code review and patch adoption; low confidence for exploitation risk because the supplied record does not include a CVSS score, exploit details, or confirmed impact. Prioritize if you maintain affected x86-64 kernel paths or vendor trees that carried the old helper interface.

Recommended defensive actions

• Review kernel trees and downstream patches for calls to the old __copy_user_nocache() interface.
• Apply the upstream Linux kernel changes referenced by the supplied stable.git commit links.
• Audit NTB and persistent-memory related code for any direct use of the helper or similar non-temporal copy paths.
• Verify that callers use the corrected interface and that any required user-space access setup remains explicit and local to the caller.
• Track vendor advisories and NVD updates, since the supplied NVD record is still marked Undergoing Analysis.

Evidence notes

All substantive claims are drawn from the supplied CVE description and the referenced upstream Linux kernel stable.git commits. The corpus indicates the issue is a rename/prototype correction and misuse cleanup in x86-64 kernel code; it does not provide CVSS data, exploitability details, affected version ranges, or a confirmed attack scenario. CVE publishedAt: 2026-05-05T16:16:16.650Z; modifiedAt: 2026-05-06T13:08:07.970Z. NVD vulnStatus in the supplied source is Undergoing Analysis.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.