Use-After-Free Vulnerability in Linux Kernel Affecting iavf Component

CVE-2026-43447

What is CVE-2026-43447?

The iavf component in the Linux kernel suffers from a use-after-free vulnerability triggered during reset operations. This issue arises when a worker designed to cache Precision Time Protocol (PTP) time continues to operate even when the adapter resources are being freed, leading to potential access of deallocated memory. Specifically, failure to properly manage the worker during a reset or disabling of the virtual function can result in race conditions that may cause system crashes. The vulnerability has been addressed by ensuring that the PTP worker is properly released before the adapter resources are torn down, safeguarding against unexpected access to freed memory and ensuring greater system reliability.

References