PT-2026-39108 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43447

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the iavf driver. A worker introduced to cache PHC (PTP Hardware Clock) time is not stopped during reset or disable operations. This creates a race condition where iavf reset task() or iavf disable vf() free adapter resources while the worker is still active. If the worker calls the iavf queue ptp cmd() function during this teardown process, it accesses freed memory or locks, resulting in a system crash.

Recommendations Call iavf ptp release() before tearing down the adapter to ensure ptp clock unregister() synchronously cancels the worker and cleans up the character device before backing resources are destroyed.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-43447

Affected Products

Linux Kernel

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43447 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43447 · Vendor Advisory
• https://git.kernel.org/stable/c/90cc8b2add29b57288025b51c70bc647e7cccb12 · Patch
• https://git.kernel.org/stable/c/1b034f2429ce6b45ce74dc266175d277acafc5c4 · Patch
• https://ubuntu.com/security/CVE-2026-43447 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43447 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43447 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43447 · Vendor Advisory
• https://git.kernel.org/stable/c/efc54fb13d79117a825fef17364315a58682c7ec · Patch
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://twitter.com/CVEnew/status/2052767620404068382 · Twitter Post
• https://git.kernel.org/linus/efc54fb13d79117a825fef17364315a58682c7ec · Note
• https://t.me/cveNotify/164412 · Telegram Post