Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-43073— x86-64: rename misleadingly named '__copy_user_nocache()' function

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于x86-64架构中__copy_user_nocache函数命名具有误导性，该函数实际使用非临时存储进行目标内存复制，但源和目标访问均需异常处理，且未对齐部分不会使用非临时存储。

EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 06917f753547e6bba8a5d17f79971d1c071a70dd< 14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd affected
06917f753547e6bba8a5d17f79971d1c071a70dd< c6d4e0599e7e73abc04e2488dfeb7940c4039660 affected
06917f753547e6bba8a5d17f79971d1c071a70dd< d993e1723aa2a085aa0d72e70ea889031fc225b4 affected
06917f753547e6bba8a5d17f79971d1c071a70dd< efea91ad1729ff1853d7418e4d3bc27d085e72d0 affected
06917f753547e6bba8a5d17f79971d1c071a70dd< d187a86de793f84766ea40b9ade7ac60aabbb4fe affected
4.2 affected
< 4.2 unaffected
6.12.83≤ 6.12.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-43073

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
x86-64: rename misleadingly named '__copy_user_nocache()' function
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于x86-64架构中__copy_user_nocache函数命名具有误导性，该函数实际使用非临时存储进行目标内存复制，但源和目标访问均需异常处理，且未对齐部分不会使用非临时存储。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 06917f753547e6bba8a5d17f79971d1c071a70dd ~ 14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd -
Linux Linux 4.2 -

II. Public POCs for CVE-2026-43073

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43073

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-43073 (5)

Proof of Concept for CVE-2026-43073 (1)

Same Patch Batch · Linux · 2026-05-05 · 15 CVEs total

CVE-2026-43067 9.8 CRITICAL ext4: handle wraparound when searching for blocks for indirect mapped blocks
CVE-2026-43071 9.1 CRITICAL dcache: Limit the minimal number of bucket to two
CVE-2026-43070 7.8 HIGH bpf: Reset register ID for BPF_END value tracking
CVE-2026-43063 7.8 HIGH xfs: don't irele after failing to iget in xfs_attri_recover_work
CVE-2026-43060 7.8 HIGH netfilter: nft_ct: drop pending enqueued packets on removal
CVE-2026-43062 7.1 HIGH Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
CVE-2026-43072 drm/vc4: platform_get_irq_byname() returns an int
CVE-2026-43069 Bluetooth: hci_ll: Fix firmware leak on error path
CVE-2026-43068 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
CVE-2026-43066 ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
CVE-2026-43065 ext4: always drain queued discard work in ext4_mb_release()
CVE-2026-43064 dmaengine: idxd: Fix not releasing workqueue on .release()
CVE-2026-43061 serial: 8250: Fix TX deadlock when using DMA
CVE-2026-43059 Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43073

No comments yet

Leave a comment