PT-2026-39018 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43357

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the mpu3050-core gyro component, the driver fails to check the return value of the pm runtime get sync() function. This allows the driver to attempt hardware access even if the device fails to resume. Additionally, the device usage count is incremented unconditionally. The issue is addressed by using pm runtime resume and get(), which ensures errors are propagated and prevents the usage count from increasing upon failure.

Recommendations Update the Linux kernel to a version where the pm runtime get sync() function is replaced by pm runtime resume and get() in the mpu3050-core driver and pm runtime put autosuspend() is added to the set 8khz samplerate() failure path in preenable.

Fix

Related Identifiers

CVE-2026-43357

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/42685cf96e28262e0b84d74447f3d99f3f6a72e0 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43357 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43357 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43357 · Vendor Advisory
• https://git.kernel.org/stable/c/7a3dec5b265cf87678b10c98a72a435a8e769bb7 · Patch
• https://git.kernel.org/stable/c/935f57dd43492240e1ca220dd065d624efece6be · Patch
• https://git.kernel.org/stable/c/acc3949aab3e8094641a9c7c2768de1958c88378 · Patch
• https://git.kernel.org/stable/c/8544c488e50206f00630a8bbba43d2c8bd290345 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43357 · Security Note
• https://git.kernel.org/stable/c/66c0d1d600e7be034959cf49edab104cb5a39258 · Patch
• https://ubuntu.com/security/CVE-2026-43357 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43357 · Vendor Advisory
• https://git.kernel.org/stable/c/35f54e7bcb1eccdc6e5bff06580eeef2e0ff3677 · Patch
• https://git.kernel.org/stable/c/2a86a396aa001a9f9ba2d37dda36573a76f17c90 · Patch