VulnerabilityPublished 5 May 2026Updated 21 Oct 2026

CVE-2026-43073: Linux kernel · x86-64: rename misleadingly named '__copy_user_nocache()' function

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in efea91ad1729ff1853d7418e4d3bc27d085e72d0 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:30 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in efea91ad1729ff1853d7418e4d3bc27d085e72d0, d993e1723aa2a085aa0d72e70ea889031fc225b4, d187a86de793f84766ea40b9ade7ac60aabbb4fe +3

Exploitation evidence

Disclosed: evidence found.
CVE published 5 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 06917f753547e6bba8a5d17f79971d1c071a70dd, < efea91ad1729ff1853d7418e4d3bc27d085e72d0	Fixed in efea91ad1729ff1853d7418e4d3bc27d085e72d0
LinuxLinux	Affected ≥ 06917f753547e6bba8a5d17f79971d1c071a70dd, < d993e1723aa2a085aa0d72e70ea889031fc225b4	Fixed in d993e1723aa2a085aa0d72e70ea889031fc225b4
LinuxLinux	Affected ≥ 06917f753547e6bba8a5d17f79971d1c071a70dd, < d187a86de793f84766ea40b9ade7ac60aabbb4fe	Fixed in d187a86de793f84766ea40b9ade7ac60aabbb4fe
LinuxLinux	Affected ≥ 06917f753547e6bba8a5d17f79971d1c071a70dd, < c6d4e0599e7e73abc04e2488dfeb7940c4039660	Fixed in c6d4e0599e7e73abc04e2488dfeb7940c4039660
LinuxLinux	Affected ≥ 06917f753547e6bba8a5d17f79971d1c071a70dd, < 73c2dc2c14d6a2efa5dde469546a907482af07fe	Fixed in 73c2dc2c14d6a2efa5dde469546a907482af07fe
LinuxLinux	Affected ≥ 06917f753547e6bba8a5d17f79971d1c071a70dd, < 14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd	Fixed in 14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd

Description

In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all.

References

Community reviews

Loading reviews…