Linux Kernel up to 6.18.15/6.19.5 mfd apple_smc_probe uninitialized pointer

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.15/6.19.5. It has been declared as critical. Affected is the function apple_smc_probe of the component mfd. Executing a manipulation can lead to uninitialized pointer. This vulnerability is registered as CVE-2026-43160. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 6.18.15/6.19.5. This vulnerability affects the function apple_smc_probe of the component mfd. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. The CWE definition for the vulnerability is CWE-824. The product accesses or uses a pointer that has not been initialized. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: mfd: macsmc: Initialize mutex Initialize struct apple_smc's mutex in apple_smc_probe(). Using the mutex uninitialized surprisingly resulted only in occasional NULL pointer dereferences in apple_smc_read() calls from the probe() functions of sub devices.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-43160 since 05/01/2026. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/17/2026).

Upgrading to version 6.18.16 or 6.19.6 eliminates this vulnerability. Applying the patch a1e9e299c0d9ea42ab1067b39fb72e976d3f1bdb/2d5932588f029f7787f52c29174fead9bbc6b2cf/414f65d6736342c77d4ec5e7373039f4a09250dd is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion