CVE-2026-43447

iavf: fix PTP use-after-free during reset

HIGH
7.8
CVSS Score
Published: May 8, 2026 at 02:22 PM UTC
Updated: August 5, 2026 at 01:24 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: iavf: fix PTP use-after-free during reset Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a worker to cache PHC time, but failed to stop it during reset or disable. This creates a race condition where `iavf_reset_task()` or `iavf_disable_vf()` free adapter resources (AQ) while the worker is still running. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it accesses freed memory/locks, leading to a crash. Fix this by calling `iavf_ptp_release()` before tearing down the adapter. This ensures `ptp_clock_unregister()` synchronously cancels the worker and cleans up the chardev before the backing resources are destroyed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.15 ≤ v < 6.18.196.15 ≤ v < 6.19.96.15 ≤ v < 7.06.19 ≤ v < 6.19.96.157.0 rc17.0 rc27.0 rc37c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0
Vendor states this is fixed in 1b034f2429ce6b45ce74dc266175d277acafc5c4 (fixed)
Vendor states this is fixed in 90cc8b2add29b57288025b51c70bc647e7cccb12 (fixed)
Vendor states this is fixed in efc54fb13d79117a825fef17364315a58682c7ec (fixed)
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.18.19 (unaffected)
Vendor states this is fixed in 6.19.9 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusANALYZED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card