{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  team: avoid NETDEV_CHANGEMTU event when unregistering slave  syzbot is reporting    unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3   ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at        __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]        netdev_hold include/linux/netdevice.h:4429 [inline]        inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286        inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600        notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85        call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]        netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886        netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907        dev_set_mtu+0x126/0x260 net/core/dev_api.c:248        team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333        team_del_slave drivers/net/team/team_core.c:1936 [inline]        team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929        notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85        call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]        call_netdevice_notifiers net/core/dev.c:2295 [inline]        __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592        do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060        rtnl_changelink net/core/rtnetlink.c:3776 [inline]        __rtnl_newlink net/core/rtnetlink.c:3935 [inline]        rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072        rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958        netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550        netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]        netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344        netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894  problem. Ido Schimmel found steps to reproduce    ip link add name team1 type team   ip link add name dummy1 mtu 1499 master team1 type dummy   ip netns add ns1   ip link set dev dummy1 netns ns1   ip -n ns1 link del dev dummy1  and also found that the same issue was fixed in the bond driver in commit f51048c3e07b (\"bonding: avoid NETDEV_CHANGEMTU event when unregistering slave\").  Let's do similar thing for the team driver, with commit ad7c7b2172c3 (\"net: hold netdev instance lock during sysfs operations\") and commit 303a8487a657 (\"net: s/__dev_set_mtu/__netif_set_mtu/\") also applied.",
  "id": "DEBIAN-CVE-2026-43234",
  "modified": "2026-09-14T16:47:35.526178172Z",
  "published": "2026-05-06T12:16:43.570Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-43234"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-43234"
  ]
}