PT-2026-37618 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-26 · CVE-2026-43278

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description Stale rq->bio values in request-based device-mapper targets can cause double-initialization of cloned bios. This leads to use-after-free and double-free scenarios. For instance, when using dm-multipath on a PCIe NVMe namespace, cloned request bios may be freed during blk complete request(), but the rq->bio pointer remains intact. A subsequent clone teardown then attempts to free the same bios again via the blk rq unprep clone() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-43278

Affected Products

Linux Kernel

References · 21

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43278 · Vendor Advisory
• https://git.kernel.org/stable/c/7daf279c674d515fb22a727a7bbc92aeb35c5442 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43278 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43278 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43278 · Vendor Advisory
• https://git.kernel.org/stable/c/9a95b98202113045bc1a5bcb30388a500f25e050 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43278 · Security Note
• https://git.kernel.org/stable/c/b1c1a2637ebd675aa2d71fee8c70da8791d73850 · Patch
• https://git.kernel.org/stable/c/8d9ddad561136f7e6a9346767bf97b4d79e38e67 · Patch
• https://git.kernel.org/stable/c/3d746b639be4b4f5cd8ce2b06aa52dc443f50edc · Patch
• https://git.kernel.org/stable/c/fb8a6c18fb9a6561f7a15b58b272442b77a242dd · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43278 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43278 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43278 · Vendor Advisory
• https://git.kernel.org/stable/c/83d72091804600ead96dc9e9f518ea56cb4942f6 · Patch