CVE-2026-43091
Published: May 6, 2026
Modified: May 11, 2026
CVSS v3.1
7.8
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first. The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU grace period before freeing the table memory. Fix this by adding synchronize_rcu() before freeing the policy hash tables.
| Vendor | Product | Versions |
|---|---|---|
Linux | Linux | affected e1e551bc56302b80ff930c966f9985095fb1b70d - < b66920a3348c0f63ba18365248fa21fbf0b3a937affected e1e551bc56302b80ff930c966f9985095fb1b70d - < 438b1f668ad58f46ce699bb48e4698a7839e3f9eaffected e1e551bc56302b80ff930c966f9985095fb1b70d - < 3733fce2871c9bca9dd18a1a23b1432ea215a094affected e1e551bc56302b80ff930c966f9985095fb1b70d - < 33a3149dd81a1e2f52b80ee1e0fc380b39f3d028affected e1e551bc56302b80ff930c966f9985095fb1b70d - < 069daad4f2ae9c5c108131995529d5f02392c446 |
Linux | Linux | affected 4.9unaffected 0 - < 4.9unaffected 6.6.136 - <= 6.6.*unaffected 6.12.83 - <= 6.12.*unaffected 6.18.24 - <= 6.18.*+2 more versions |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now