PT-2026-37487 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-29 · CVE-2026-43147

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock occurs in the Linux kernel when sriov del vfs() is called as part of pci stop and remove bus device(). This happens because the system recursively attempts to acquire the pci rescan remove lock while the lock is already held. The issue can be triggered by writing to the sriov numvfs and remove files within the /sys/bus/pci/devices/ directory. The deadlock involves the sriov disable() function and the pci stop and remove bus device locked() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-43147

OESA-2026-2418

OESA-2026-2493

Affected Products

Linux Kernel

References · 160

• https://nvd.nist.gov/vuln/detail/CVE-2025-38462 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38123 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-37905 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39812 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23317 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38552 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68304 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23157 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38609 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38461 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68284 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38364 · Security Note