CVE-2026-43447: iavf: fix PTP use-after-free during reset
In the Linux kernel, the following vulnerability has been resolved:
iavf: fix PTP use-after-free during reset
Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a worker to cache PHC time, but failed to stop it during reset or disable.
This creates a race condition where iavfresettask() or iavfdisablevf() free adapter resources (AQ) while the worker is still running. If the worker triggers iavfqueueptpcmd() during teardown, it accesses freed memory/locks, leading to a crash.
Fix this by calling iavfptprelease() before tearing down the adapter. This ensures ptpclockunregister() synchronously cancels the worker and cleans up the chardev before the backing resources are destroyed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Before tearing down the iavf adapter, call `iavf_ptp_release()`. During teardown/reset/disable, ensure `ptp_clock_unregister()` synchronously cancels the worker before `iavf_disable_vf()` frees adapter resources, and clean up the chardev before destroying backing resources to prevent worker access to freed memory/locks.
iavf (Linux kernel driver) PTP adapter teardown order = Call iavf_ptp_release() before tearing down the adapter; ensure iavf_queue_ptp_cmd() worker is synchronously cancelled before iavf_disable_vf() frees adapter resources (AQ)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43447?
CVE-2026-43447 has a severity rating that necessitates prompt attention due to the potential use-after-free vulnerability.
How do I fix CVE-2026-43447?
To fix CVE-2026-43447, update the Linux kernel to the latest stable version that addresses the use-after-free vulnerability in the iavf driver.
Which software is affected by CVE-2026-43447?
CVE-2026-43447 affects the Linux kernel specifically in the iavf driver component.
What causes the vulnerability in CVE-2026-43447?
The vulnerability in CVE-2026-43447 is caused by a failure to stop a worker that caches PHC time during a reset or disable operation.
What potential impact does CVE-2026-43447 have on systems?
CVE-2026-43447 could lead to system instability or crashes due to the use-after-free condition if exploited.