VulnerabilityPublished 6 May 2026Updated 6 Nov 2026

CVE-2026-43147: Linux kernel · Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f61cdd7e9b67bb8961b0a81bf294b78343e5db05 : patch Linux kernel soon.

Data as of 6 Nov 2026, 16:04 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f61cdd7e9b67bb8961b0a81bf294b78343e5db05, d47f27e145f8bd13f3c230da5e3af29225b4a2f7, 639265296fe6ee21b6f00e00ee2bab65f3b07252 +12

Exploitation evidence

Disclosed: evidence found.
CVE published 6 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.10.246 <5.10.252 >=5.15.195 <5.15.202 >=6.1.157 <6.1.165 >=6.6.113 <6.6.128 >=6.12.54 <6.12.75 >=5.4.301 <5.5 >=6.17.4 <6.18	Fixed in f61cdd7e9b67bb8961b0a81bf294b78343e5db05 d47f27e145f8bd13f3c230da5e3af29225b4a2f7 639265296fe6ee21b6f00e00ee2bab65f3b07252 58677783c89681871077f50a7042b0c6380c4fd8 83651d37474c762920e345a3a0828f975ca4d732 40f67686a5002c0c322fac918406bbc8d9c2ec2f 6.18 6.12.75 6.6.128 6.1.165 5.15.202 5.10.252 5.5 2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a 0de341b2365bad430aade0853fe09c2cbe468f59
LinuxLinux	Affected =6.18	Fixed in–

AI-suggested

A fix for this vulnerability is available in Linux kernel versions 6.18, 6.12.75, 6.6.128, 6.1.165, and others as identified by specific commit hashes. Users and administrators should upgrade to these fixed versions to resolve the deadlock issue. Since the revert restores the deadlock, running affected versions without the fix may cause system instability. No other mitigation or workaround is indicated in the advisory.

Description

CVE-2026-43147 is a Linux kernel vulnerability involving a deadlock caused by recursive locking in the PCI rescan-remove locking mechanism when enabling or disabling SR-IOV. The issue occurs due to a reverted commit that introduced a deadlock when sriov_del_vfs() is called during device removal. This deadlock can manifest when writing to sysfs interfaces related to SR-IOV virtual functions and device removal. The revert restores the deadlock issue, and a new fix is planned to address the root cause properly.

Impact

The vulnerability causes a kernel deadlock during PCI device removal when SR-IOV virtual functions are enabled or disabled. This can lead to system hangs or unresponsiveness when managing PCI devices with SR-IOV, impacting system stability and availability. There is no indication of privilege escalation or data corruption from the provided data.

Summary

This vulnerability in the Linux kernel arises from a deadlock caused by recursive acquisition of pci_rescan_remove_lock during SR-IOV virtual function removal. The problematic commit that added locking to prevent other issues was reverted because it caused deadlocks when sriov_del_vfs() is invoked as part of pci_stop_and_remove_bus_device(). The deadlock occurs during sequences such as writing to /sys/bus/pci/devices/<pf>/sriov_numvfs followed by writing to /sys/bus/pci/devices/<pf>/remove, particularly on mlx5 devices. The revert restores the deadlock issue the original commit tried to fix, and a new fix will be provided later. Multiple Linux kernel versions are affected, with fixes available in versions 6.18, 6.12.75, 6.6.128, 6.1.165, and others as listed by commit hashes.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:03 UTC

Technical details

References

Community reviews

Related threats