CVE-2026-43091

xfrm: Wait for RCU readers during policy netns exit

State: Published
Severity: 7.8 High
Published: May 6, 2026
Updated: Oct 30, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Wait for RCU readers during policy netns exit

xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first.

The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU grace period before freeing the table memory.

Fix this by adding synchronize_rcu() before freeing the policy hash tables.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	e1e551bc56302b80ff930c966f9985095fb1b70d to before b2faee12538b5b008eaef65a4201eb29cb5cefb3Affected e1e551bc56302b80ff930c966f9985095fb1b70d to before b66920a3348c0f63ba18365248fa21fbf0b3a937Affected e1e551bc56302b80ff930c966f9985095fb1b70d to before 438b1f668ad58f46ce699bb48e4698a7839e3f9eAffected e1e551bc56302b80ff930c966f9985095fb1b70d to before 3733fce2871c9bca9dd18a1a23b1432ea215a094Affected e1e551bc56302b80ff930c966f9985095fb1b70d to before 33a3149dd81a1e2f52b80ee1e0fc380b39f3d028Affected e1e551bc56302b80ff930c966f9985095fb1b70d to before 069daad4f2ae9c5c108131995529d5f02392c446Affected
LinuxLinux	4.9Affected before 4.9Not affected 6.1.191 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

e1e551bc56302b80ff930c966f9985095fb1b70d to before b2faee12538b5b008eaef65a4201eb29cb5cefb3Affected
e1e551bc56302b80ff930c966f9985095fb1b70d to before b66920a3348c0f63ba18365248fa21fbf0b3a937Affected
e1e551bc56302b80ff930c966f9985095fb1b70d to before 438b1f668ad58f46ce699bb48e4698a7839e3f9eAffected
e1e551bc56302b80ff930c966f9985095fb1b70d to before 3733fce2871c9bca9dd18a1a23b1432ea215a094Affected
e1e551bc56302b80ff930c966f9985095fb1b70d to before 33a3149dd81a1e2f52b80ee1e0fc380b39f3d028Affected
e1e551bc56302b80ff930c966f9985095fb1b70d to before 069daad4f2ae9c5c108131995529d5f02392c446Affected

LinuxLinux

4.9Affected
before 4.9Not affected
6.1.191 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.