PT-2026-38997 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43346

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In VFIO passthrough setups, it is possible to pass through only a Physical Function (PF) that does not own the source timer. In such configurations, the PTP controlling PF (adapter->ctrl pf) is not initialized in the Virtual Machine (VM), causing the ice get ctrl ptp() function to return NULL. This triggers a WARN ON() call within the ice ptp setup pf() function. This behavior is expected in these specific configurations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-43346

Affected Products

Linux Kernel

References · 15

• https://ubuntu.com/security/CVE-2026-43346 · Vendor Advisory
• https://git.kernel.org/stable/c/e19675b384e9dcaca1bd5e4a67b8ad136eccfbe8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43346 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43346 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43346 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43346 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43346 · Vendor Advisory
• https://git.kernel.org/stable/c/c73f365707d3b1b78b7d16e1f029020d1ae50d0f · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43346 · Vendor Advisory
• https://git.kernel.org/stable/c/bb3f21edc7056cdf44a7f7bd7ba65af40741838c · Patch
• https://git.kernel.org/linus/bb3f21edc7056cdf44a7f7bd7ba65af40741838c · Note
• https://twitter.com/CVEnew/status/2052811030108008701 · Twitter Post
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://t.me/cveNotify/163670 · Telegram Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43346 · Note