CVE-2026-43007 is a high-severity vulnerability in the Linux kernel's accel/qaic component. It occurs when a Device Block Controller (DBC) is released but the user process goes away before the deactivation transaction is fully handled. This causes the host to become out-of-sync with available DBCs, leading to resource leaks and indefinite hangs when the same DBC is reassigned. The issue is resolved by properly handling deactivation transactions even after the user has disconnected.