PT-2026-37400 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-07 · CVE-2026-43090

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak exists in the Linux kernel due to a reference count imbalance. The issue occurs within the xfrm migrate policy find() function, which performs a double call to the xfrm pol hold rcu() function. Because the lookup function already returns a policy with a held reference, the second call is redundant, leading to a leak in xfrm policy alloc().

Recommendations Remove the redundant xfrm pol hold rcu() call within the xfrm migrate policy find() function.

Related Identifiers

CVE-2026-43090

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-43090 · Security Note
• https://twitter.com/VulmonFeeds/status/2052041145283223975 · Twitter Post
• https://git.kernel.org/stable/c/83317cce60a032c49480dcdabe146435bd689d03 · Note
• https://twitter.com/vuldb/status/2052298437044109645 · Twitter Post
• https://git.kernel.org/stable/c/70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a · Note
• https://git.kernel.org/stable/c/21e235a36cfb6d145cefb10728f12f5dc5412f54 · Note
• https://git.kernel.org/stable/c/836ee1b0426ea3db31531e9581cc32f513d24e32 · Note