PT-2026-39035 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-08 · CVE-2026-43374

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel within the remove nh grp entry() function. The system publishes a new group using rcu assign pointer() and immediately frees the removed entry's percpu stats via free percpu(). Because the synchronize net() grace period occurs after this free operation, RCU readers that entered before the publish can still access the old group and dereference the freed stats through nh grp entry stats inc() and get cpu ptr(nhge->stats), leading to a use-after-free on percpu memory.

Recommendations Defer the free percpu() operation until after the synchronize net() grace period in the caller function by chaining removed entries via nh list onto a local deferred free list.

Related Identifiers

CVE-2026-43374

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43374 · Security Note
• https://git.kernel.org/stable/c/abf4feaee6405f1441929c6ebe7a250f2cd170a7 · Note
• https://git.kernel.org/stable/c/ab5ebab9664214ba41a7633cb4e72f128204f924 · Note
• https://git.kernel.org/stable/c/b2662e7593e94ae09b1cf7ee5f09160a3612bcb2 · Note
• https://git.kernel.org/stable/c/9e08ad731862b22a87cc55f752e16d66cdc9e231 · Note
• https://twitter.com/CVEnew/status/2052810996398326262 · Twitter Post