PT-2026-37401 · Linux · Linux

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-43091

NVD

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Wait for RCU readers during policy netns exit

xfrm policy fini() frees the policy bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first.

The policy bydst tables are published via rcu assign pointer() and are looked up through rcu dereference check(), so netns teardown must also wait for an RCU grace period before freeing the table memory.

Fix this by adding synchronize rcu() before freeing the policy hash tables.

Related Identifiers

CVE-2026-43091

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43091 · Security Note
• https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937 · Note
• https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9e · Note
• https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446 · Note
• https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094 · Note
• https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028 · Note