PT-2026-39043 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43382

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock can occur in the batman-adv module when the batadv v elp get throughput() function is called while the RTNL (Routing Netlink) lock is already held. This specifically happens when a work queue item is cancelled via cancel delayed work sync() in batadv v elp iface disable(). While rtnl trylock() was previously implemented to avoid this, the batadv get real netdev() function was still being called for cfg80211 interfaces, which also attempts to acquire the rtnl lock(), leading to the deadlock.

Recommendations Update the Linux kernel to a version where the batadv get real netdev() lockless version and ethtool get link ksettings() are utilized to prevent double-locking.

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-43382

Affected Products

Linux Kernel

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43382 · Vendor Advisory
• https://git.kernel.org/stable/c/77808fe7d03ad0062840b95f431869a8b3d88b24 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43382 · Security Note
• https://ubuntu.com/security/CVE-2026-43382 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43382 · Vendor Advisory
• https://git.kernel.org/stable/c/f3ca45673dab0514a887231de6f3243a699d5bfd · Patch
• https://git.kernel.org/stable/c/fa7b4edfbabdf9235b0ab4bea297fc12b3bec9ca · Patch
• https://git.kernel.org/stable/c/4c3ae249431b4fcb315d7dfb4c3a13f9e443fd9b · Patch
• https://git.kernel.org/stable/c/cfc83a3c71517b59c1047db57da31e26a9dc2f33 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43382 · Vendor Advisory
• https://git.kernel.org/stable/c/192f40ad8a7dac58dae9199a065dbf7e6e67b75b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43382 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43382 · Vendor Advisory
• https://git.kernel.org/stable/c/2ab9f2531d37775cd79228c1f5d80e6bd08d11d3 · Patch
• https://git.kernel.org/stable/c/b7e5d8ddfdf1d6e9e0808d1adf7736a107372d77 · Patch