CVE-2026-43447 (GCVE-0-2026-43447)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:22 – Updated: 2026-08-05 12:28
VLAI
Title
iavf: fix PTP use-after-free during reset
Summary
In the Linux kernel, the following vulnerability has been resolved: iavf: fix PTP use-after-free during reset Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a worker to cache PHC time, but failed to stop it during reset or disable. This creates a race condition where `iavf_reset_task()` or `iavf_disable_vf()` free adapter resources (AQ) while the worker is still running. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it accesses freed memory/locks, leading to a crash. Fix this by calling `iavf_ptp_release()` before tearing down the adapter. This ensures `ptp_clock_unregister()` synchronously cancels the worker and cleans up the chardev before the backing resources are destroyed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0 , < 1b034f2429ce6b45ce74dc266175d277acafc5c4 (git)
Affected: 7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0 , < 90cc8b2add29b57288025b51c70bc647e7cccb12 (git)
Affected: 7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0 , < efc54fb13d79117a825fef17364315a58682c7ec (git)
Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b034f2429ce6b45ce74dc266175d277acafc5c4",
              "status": "affected",
              "version": "7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0",
              "versionType": "git"
            },
            {
              "lessThan": "90cc8b2add29b57288025b51c70bc647e7cccb12",
              "status": "affected",
              "version": "7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0",
              "versionType": "git"
            },
            {
              "lessThan": "efc54fb13d79117a825fef17364315a58682c7ec",
              "status": "affected",
              "version": "7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix PTP use-after-free during reset\n\nCommit 7c01dbfc8a1c5f (\"iavf: periodically cache PHC time\") introduced a\nworker to cache PHC time, but failed to stop it during reset or disable.\n\nThis creates a race condition where `iavf_reset_task()` or\n`iavf_disable_vf()` free adapter resources (AQ) while the worker is still\nrunning. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it\naccesses freed memory/locks, leading to a crash.\n\nFix this by calling `iavf_ptp_release()` before tearing down the adapter.\nThis ensures `ptp_clock_unregister()` synchronously cancels the worker and\ncleans up the chardev before the backing resources are destroyed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable reset/disable paths are reached through local netdevice/PTP control paths, not by processing remote packets. A local actor can trigger iavf reset via MTU/feature changes while the PTP worker or PTP clock access queues PHC reads.\nAC:L - The race can be driven repeatedly by triggering resets while the PTP aux worker runs periodically, and a privileged local actor can also issue concurrent PTP clock reads. Per kernel guidance, this use-after-free race is low complexity.\nPR:L - Reset-triggering netdevice operations require CAP_NET_ADMIN in the device\u0027s network namespace, enforced through namespace-capable checks. Since iavf devices are not netns-immutable and may be delegated to a user-owned netns/container, this is low privileges rather than init-namespace root only.\nUI:N - No victim action is required once the attacker has local access and the iavf VF with PTP support is present. The attacker can initiate the reset/clock activity directly.\nS:U - The corruption occurs within the same kernel security authority as the vulnerable iavf driver. This is standard local kernel compromise/DoS, not a guest-to-host or IOMMU boundary crossing.\nC:H - The bug is a use-after-free involving freed adapter/Admin Queue resources and locks. Following kernel guidance, UAF memory corruption can provide high confidentiality impact through exploitable kernel memory access.\nI:H - The UAF can corrupt or reuse kernel objects/resources during teardown and can plausibly be exploited for control-flow or arbitrary write primitives. Kernel guidance treats use-after-free as high integrity impact.\nA:H - The reported failure mode is a kernel crash in the PTP worker/iavf path during reset teardown. Any reproducible kernel oops/panic from this UAF is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:00.059Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b034f2429ce6b45ce74dc266175d277acafc5c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/90cc8b2add29b57288025b51c70bc647e7cccb12"
        },
        {
          "url": "https://git.kernel.org/stable/c/efc54fb13d79117a825fef17364315a58682c7ec"
        }
      ],
      "title": "iavf: fix PTP use-after-free during reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43447",
    "datePublished": "2026-05-08T14:22:13.988Z",
    "dateReserved": "2026-05-01T14:12:56.010Z",
    "dateUpdated": "2026-08-05T12:28:00.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43447",
      "date": "2026-10-02",
      "epss": "0.00168",
      "percentile": "0.05561"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/iavf/iavf_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1b034f2429ce6b45ce74dc266175d277acafc5c4",
                    "status": "affected",
                    "version": "7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "90cc8b2add29b57288025b51c70bc647e7cccb12",
                    "status": "affected",
                    "version": "7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "efc54fb13d79117a825fef17364315a58682c7ec",
                    "status": "affected",
                    "version": "7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/iavf/iavf_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6461E17-9936-4679-8F97-568871A6FBE4",
                    "versionEndExcluding": "6.18.19",
                    "versionStartIncluding": "6.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9",
                    "versionEndExcluding": "6.19.9",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix PTP use-after-free during reset\n\nCommit 7c01dbfc8a1c5f (\"iavf: periodically cache PHC time\") introduced a\nworker to cache PHC time, but failed to stop it during reset or disable.\n\nThis creates a race condition where `iavf_reset_task()` or\n`iavf_disable_vf()` free adapter resources (AQ) while the worker is still\nrunning. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it\naccesses freed memory/locks, leading to a crash.\n\nFix this by calling `iavf_ptp_release()` before tearing down the adapter.\nThis ensures `ptp_clock_unregister()` synchronously cancels the worker and\ncleans up the chardev before the backing resources are destroyed."
          }
        ],
        "id": "CVE-2026-43447",
        "lastModified": "2026-06-17T10:49:37.043",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-08T15:16:57.217",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1b034f2429ce6b45ce74dc266175d277acafc5c4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/90cc8b2add29b57288025b51c70bc647e7cccb12"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/efc54fb13d79117a825fef17364315a58682c7ec"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:55:19+00:00",
      "cve": "CVE-2026-43447",
      "id": "CVE-2026-43447",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_affected": "182",
      "product_status:known_not_affected": "92",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iavf: fix PTP use-after-free during reset",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43447.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-01T01:17:32Z",
      "cve": "CVE-2026-43447",
      "id": "CVE-2026-43447",
      "initial_release_date": "2026-05-11T14:13:30Z",
      "product_status:known_not_affected": "385",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43447",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43447.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.