CVE-2026-43447

iavf: fix PTP use-after-free during reset

High · published May 8, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iavf: fix PTP use-after-free during reset

Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a

worker to cache PHC time, but failed to stop it during reset or disable.

This creates a race condition where `iavf_reset_task()` or

`iavf_disable_vf()` free adapter resources (AQ) while the worker is still

running. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it

accesses freed memory/locks, leading to a crash.

Fix this by calling `iavf_ptp_release()` before tearing down the adapter.

This ensures `ptp_clock_unregister()` synchronously cancels the worker and

cleans up the chardev before the backing resources are destroyed.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.9th percentile
Published
2026-05-08T14:22Z
EPSS history
Timeline
  • 08 MAY 14:22Z
    iavf: fix PTP use-after-free during reset
    cvelistv5