PT-2026-36462 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-26 · CVE-2026-43045

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mshv region pin() function regarding error handling. First, the pin user pages fast() function may return a short pin count (greater than zero but less than requested) when unable to pin all pages; treating this as a success leads to the use of partially pinned regions, resulting in memory corruption. Second, if an error occurs during a loop, pinned pages from the current batch are not correctly accounted for before mshv region invalidate pages() is called, which causes a page reference leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43045

Affected Products

Linux Kernel

References · 12

• https://git.kernel.org/stable/c/c0e296f257671ba10249630fe58026f29e4804d9 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43045 · Vendor Advisory
• https://git.kernel.org/stable/c/a7d149152bc5a9119854331c57be35ad31fdf5cc · Patch
• https://cve.org/CVERecord?id=CVE-2026-43045 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43045 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43045 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43045 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43045 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43045 · Vendor Advisory
• https://t.me/cveNotify/162705 · Telegram Post
• https://t.me/CVEtracker/52416 · Telegram Post
• https://git.kernel.org/linus/c0e296f257671ba10249630fe58026f29e4804d9 · Note