CVE-2026-43447 PUBLISHED

iavf: fix PTP use-after-free during reset

Assigner: Linux
Reserved: 01.05.2026 Published: 08.05.2026 Updated: 08.05.2026

In the Linux kernel, the following vulnerability has been resolved:

iavf: fix PTP use-after-free during reset

Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a worker to cache PHC time, but failed to stop it during reset or disable.

This creates a race condition where iavf_reset_task() or iavf_disable_vf() free adapter resources (AQ) while the worker is still running. If the worker triggers iavf_queue_ptp_cmd() during teardown, it accesses freed memory/locks, leading to a crash.

Fix this by calling iavf_ptp_release() before tearing down the adapter. This ensures ptp_clock_unregister() synchronously cancels the worker and cleans up the chardev before the backing resources are destroyed.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0 to 1b034f2429ce6b45ce74dc266175d277acafc5c4 (excl.)
  • affected from 7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0 to 90cc8b2add29b57288025b51c70bc647e7cccb12 (excl.)
  • affected from 7c01dbfc8a1c5f8b8e4a7907ab06db1449d478d0 to efc54fb13d79117a825fef17364315a58682c7ec (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.15 is affected
  • unaffected from 0 to 6.15 (excl.)
  • unaffected from 6.18.19 to 6.18.* (incl.)
  • unaffected from 6.19.9 to 6.19.* (incl.)
  • unaffected from 7.0 to * (incl.)

References