CVE-2026-43091 Details
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first. The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU grace period before freeing the table memory. Fix this by adding synchronize_rcu() before freeing the policy hash tables.
A vulnerability in the Linux kernel's handling of XFRM policy management can lead to a use-after-free issue. During the exit of a network namespace, the function responsible for finalizing XFRM policies frees the policy_bydst hash tables without waiting for ongoing RCU (Read-Copy-Update) readers to finish their critical sections. This can cause the memory of the hash tables, which are managed through RCU, to be freed while still in use, leading to potential instability or crashes. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been fixed in the Linux kernel stable tree by adding a call to synchronize_rcu() before freeing the policy hash tables, ensuring that all RCU readers have exited their critical sections. Users should upgrade to the latest version of the Linux kernel stable tree where this fix is applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446 | kernel.org | Patch |
| https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094 | kernel.org | Patch |
| https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9e | kernel.org | Patch |
| https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.9, < 6.6.136 >= 6.7, < 6.12.83 >= 6.13, < 6.18.24 >= 6.19, < 6.19.14 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 7.0 rc7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | CVE Modified | kernel.org |
| May 6, 2026 | New CVE Received | kernel.org |