CVE-2026-43346 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators, and users of VFIO passthrough setups should assess their exposure and review system configurations. Linux kernel versions 6.12.11 through 6.13, 6.19 through 6.19.14, and 7.0 rc1 through rc7 may be affected, and operators, platform administrators, vulnerability management teams, and security teams should verify their configurations and apply patches as available.

Why it matters

CVE-2026-43346 is a Linux kernel vulnerability that has been resolved. It concerns the handling of PTP controlling PFs in VFIO passthrough setups. While the vulnerability does not require immediate action, Linux kernel maintainers and administrators should review their configurations for potential impact and apply patches as available.

• Verification of system configurations for VFIO passthrough setups is necessary.
• Review of Linux kernel versions for potential exposure is required.
• Application of patches as available from the Linux kernel repository is recommended.

Technical summary

The Linux kernel vulnerability (CVE-2026-43346) involves the handling of PTP controlling PFs in VFIO passthrough setups. When a PF is passed through without owning the source timer, the PTP controlling PF is uninitialized in the VM, triggering a warning. This has been replaced with an informational message, and the function returns -EOPNOTSUPP. The vulnerability has been resolved, and Linux kernel maintainers and administrators should review their configurations for potential impact and apply patches as available. The affected products include Linux kernel versions 6.12.11 through 6.13, 6.19 through 6.19.14, and 7.0 rc1 through rc7.

Defensive priority

Medium priority for Linux kernel maintainers and administrators, as the vulnerability has been resolved and does not require immediate action but should be reviewed for potential impact.

Recommended defensive actions

• Review Linux kernel versions 6.12.11 through 6.13, 6.19 through 6.19.14, and 7.0 rc1 through rc7 for potential exposure.
• Verify system configurations for VFIO passthrough setups.
• Apply patches as available from the Linux kernel repository.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and associated sources provide details on the vulnerability and its resolution. Specific details about affected versions and exploitation are limited. Linux kernel maintainers and administrators should verify system configurations for VFIO passthrough setups, review Linux kernel versions for potential exposure, and apply patches as available from the Linux kernel repository. The evidence is based on the official CVE record and associated sources, which may have limited information on affected versions and exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.