PT-2026-38948 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43306

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A type mismatch occurs in the Linux kernel when CONFIG CFI (Control Flow Integrity, a security mechanism that ensures indirect function calls target the correct function type) is enabled. This happens because the destructor kfunc type does not match the target function bpf crypto ctx release(), which can lead to a CFI failure and a system crash (Oops).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43306

Affected Products

Linux Kernel

References · 17

• https://security-tracker.debian.org/tracker/CVE-2026-43306 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43306 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43306 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43306 · Vendor Advisory
• https://git.kernel.org/stable/c/3979a550fe06b370d73647f59cf462fa525c9ec4 · Patch
• https://ubuntu.com/security/CVE-2026-43306 · Vendor Advisory
• https://git.kernel.org/stable/c/4e3e57dbf46dad3498f8c4219ce2dba756875962 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43306 · Security Note
• https://git.kernel.org/stable/c/b40a5d724f29fc2eed23ff353808a9aae616b48a · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43306 · Vendor Advisory
• https://git.kernel.org/stable/c/50d6fd69388cc7b05dce72f09080674dcede4ac9 · Patch
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://twitter.com/windowsforum/status/2053766726890758205 · Twitter Post
• https://t.me/cveNotify/163671 · Telegram Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43306 · Note