PT-2026-37400 · Linux · Linux

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-43090

Mitre

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix refcount leak in xfrm migrate policy find

syzkaller reported a memory leak in xfrm policy alloc:

BUG: memory leak unreferenced object 0xffff888114d79000 (size 1024): comm "syz.1.17", pid 931 ... xfrm policy alloc+0xb3/0x4b0 net/xfrm/xfrm policy.c:432

The root cause is a double call to xfrm pol hold rcu() in xfrm migrate policy find(). The lookup function already returns a policy with held reference, making the second call redundant.

Remove the redundant xfrm pol hold rcu() call to fix the refcount imbalance and prevent the memory leak.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Related Identifiers

CVE-2026-43090

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-43090 · Security Note
• https://git.kernel.org/stable/c/836ee1b0426ea3db31531e9581cc32f513d24e32 · Note
• https://git.kernel.org/stable/c/21e235a36cfb6d145cefb10728f12f5dc5412f54 · Note
• https://git.kernel.org/stable/c/70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a · Note
• https://git.kernel.org/stable/c/83317cce60a032c49480dcdabe146435bd689d03 · Note