PT-2026-37478 · Linux+3 · Linux+107

Published 2026-05-06 · Updated 2026-05-09 · CVE-2026-43138

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel involving the gpio reset device. This special device is created dynamically and intended to remain in memory indefinitely. Due to the absence of a devlink between the device and the actual reset consumer, allowing user-space to unbind the device via sysfs bind attributes can lead to a use-after-free condition when a user utilizes the reset control handle.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-43138

Affected Products

Linux

Linux-Allwinner-5.19

Linux-Aws

Linux-Aws-5.0

Linux-Aws-5.11

Linux-Aws-5.13

Linux-Aws-5.19

Linux-Aws-5.3

Linux-Aws-5.8

Linux-Aws-6.14

Linux-Aws-6.17

Linux-Aws-6.2

Linux-Aws-6.5

Linux-Azure

Linux-Azure-5.11

Linux-Azure-5.13

Linux-Azure-5.19

Linux-Azure-5.3

Linux-Azure-5.8

Linux-Azure-6.11

Linux-Azure-6.14

Linux-Azure-6.17

Linux-Azure-6.2

Linux-Azure-6.5

Linux-Azure-Edge

Linux-Azure-Fde

Linux-Azure-Fde-5.19

Linux-Azure-Fde-6.14

Linux-Azure-Fde-6.17

Linux-Azure-Fde-6.2

Linux-Azure-Nvidia-6.14

Linux-Gcp

Linux-Gcp-5.11

Linux-Gcp-5.13

Linux-Gcp-5.19

Linux-Gcp-5.3

Linux-Gcp-5.8

Linux-Gcp-6.11

Linux-Gcp-6.14

Linux-Gcp-6.17

Linux-Gcp-6.2

Linux-Gcp-6.5

Linux-Gke

Linux-Gke-4.15

Linux-Gkeop-5.15

Linux-Gke-5.4

Linux-Gkeop

Linux-Hwe

Linux-Hwe-5.11

Linux-Hwe-5.13

Linux-Hwe-5.19

Linux-Hwe-5.8

Linux-Hwe-6.11

Linux-Hwe-6.14

Linux-Hwe-6.17

Linux-Hwe-6.2

Linux-Hwe-6.5

Linux-Hwe-Edge

Linux-Intel-5.13

Linux-Intel-Iot-Realtime

Linux-Lowlatency-Hwe-5.19

Linux-Lowlatency-Hwe-6.11

Linux-Lowlatency-Hwe-6.2

Linux-Lowlatency-Hwe-6.5

Linux-Lts

Linux-Nvidia

Linux-Nvidia-6.11

Linux-Nvidia-6.2

Linux-Nvidia-6.5

Linux-Oem

Linux-Oem-5.10

Linux-Oem-5.13

Linux-Oem-5.14

Linux-Oem-5.17

Linux-Oem-5.6

Linux-Oem-6.0

Linux-Oem-6.1

Linux-Oem-6.11

Linux-Oem-6.14

Linux-Oem-6.17

Linux-Oem-6.5

Linux-Oem-6.8

Linux-Oracle

Linux-Oracle-5.0

Linux-Oracle-5.11

Linux-Oracle-5.13

Linux-Oracle-5.3

Linux-Oracle-5.8

Linux-Oracle-6.14

Linux-Oracle-6.17

Linux-Oracle-6.5

Linux-Raspi

Linux-Raspi-Realtime

Linux-Raspi2

Linux-Realtime

Linux-Realtime-6.14

Linux-Realtime-6.17

Linux-Riscv

Linux-Riscv-5.11

Linux-Riscv-5.19

Linux-Riscv-5.8

Linux-Riscv-6.14

Linux-Riscv-6.17

Linux-Riscv-6.5

Linux-Starfive-5.19

Linux-Starfive-6.2

Linux-Starfive-6.5

Linux Kernel

References · 13

• https://git.kernel.org/stable/c/09d6efc6abd42809956d598906c222ccd1c8ae92 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43138 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43138 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43138 · Vendor Advisory
• https://git.kernel.org/stable/c/1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43138 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43138 · Vendor Advisory
• https://git.kernel.org/stable/c/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952 · Patch
• https://git.kernel.org/stable/c/76801c3dfca0ac6339a23e9615b5f23e25b8644c · Patch
• https://cve.org/CVERecord?id=CVE-2026-43138 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43138 · Vendor Advisory
• https://docs.bell-sw.com/security/cves/CVE-2026-43138 · Note
• https://git.kernel.org/linus/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952 · Note