PT-2026-38937 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-43295

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the rio scan alloc net() function where rio free net() was used instead of kfree() during a failure in idtab allocation. Because the net is not yet registered with rio add net() at that stage, kfree(net) is the appropriate method to release memory. Additionally, the mport->net variable must be set to NULL to prevent a dangling pointer, which is a pointer that continues to reference a memory location after the memory has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43295

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/83e579c2f7f6b1706323d744833b26470049dcc2 · Patch
• https://git.kernel.org/stable/c/87272e3e70ec4b666885bd520ff77463c11444ef · Patch
• https://git.kernel.org/stable/c/fecf292c6691970897396190855aa38826b7104e · Patch
• https://git.kernel.org/stable/c/666183dcdd9ad3b8156a1df7f204f728f720380f · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43295 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43295 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43295 · Vendor Advisory
• https://git.kernel.org/stable/c/34a4f233df5eef5f1f113b2196142c0568b387f8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43295 · Security Note
• https://git.kernel.org/stable/c/649c2e853608cad0b0cba545555d168e67f094b3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43295 · Vendor Advisory
• https://git.kernel.org/stable/c/78812c4fb7ed242d5961bf1337a49070d6487c94 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43295 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43295 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43295 · Security Note