HIGH
accel/qaic DBC Leak
CVE-2026-43007
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away.
02KernelScan AI Analysis
Risk summary
Local users with access to QAIC AI accelerator devices can cause resource exhaustion by triggering DBC (Data Buffer Control) resource leaks. This leads to denial of service where subsequent users cannot activate networks and processes hang indefinitely waiting for resources that are never freed. The device remains unusable for acceleration workloads until reset or module re-insertion.
Vulnerability analysis
The vulnerability occurs in the QAIC accelerator control path when handling DBC deactivation messages from the device. When a user process exits before receiving a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction, the host fails to release DBC resources because decode_deactivate() was only called in qaic_manage_ioctl() context while a user was waiting. This causes a synchronization mismatch between device and host state. The fix adds logic in resp_worker() to detect orphaned deactivation messages and handle them even when no user is waiting, ensuring proper resource cleanup.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.81 | 08021f2d4a55 |
| 6.18 | 6.18.22 | f403094d9075 |
| 6.19 | 6.19.12 | ee0180e77e6c |
| 6.6 | 6.6.134 | 2dd67966f39a |
| mainline | 7.0 | 2feec5ae5df7 |