PT-2026-37600 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-08 · CVE-2026-43260

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bnxt en driver regarding the RSS context delete logic. The driver incorrectly used a netif running() check when deleting an RSS context, which caused VNICs (Virtual Network Interface Cards) to leak in the firmware whenever a close() operation occurred with active RSS contexts. During a subsequent open() operation, the driver attempts to create extra VNICs during RSS context restoration without prior reservation, which may lead the firmware to fail the request and result in the loss of active RSS contexts.

Recommendations Remove the netif running() condition check when deleting an RSS context.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-43260

Affected Products

Linux Kernel

References · 14

• https://ubuntu.com/security/CVE-2026-43260 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43260 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-43260 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43260 · Vendor Advisory
• https://git.kernel.org/stable/c/9a9b89eea4a9cc7726702946ff688d716962fabd · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43260 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43260 · Vendor Advisory
• https://git.kernel.org/stable/c/348a5f8d06c7bdf954e13c17ad5f80b59a075604 · Patch
• https://git.kernel.org/stable/c/e123d9302d223767bd910bfbcfe607bae909f8ac · Patch
• https://git.kernel.org/stable/c/079986d6db1f8e3d50c55f400cf998ac9690d2c8 · Patch
• https://git.kernel.org/linus/e123d9302d223767bd910bfbcfe607bae909f8ac · Note
• https://t.me/cveNotify/162789 · Telegram Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43260 · Note