CVE-2026-43071: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43071 Overview

CVE-2026-43071 is an out-of-bounds read vulnerability in the Linux kernel's directory entry cache (dcache) subsystem. The flaw occurs when the boot parameter dhash_entries=1 causes dentry_hashtable to allocate only one bucket. Under this configuration, dcache_init() calculates d_hash_shift as 32, which equals the bit width of the u32 operand used in subsequent right-shift operations. The resulting undefined behavior causes __d_lookup to read memory outside the allocated hash table, triggering a kernel page fault during early initialization paths such as debugfs_create_dir invoked by pinctrl_init.

Critical Impact
Local users with the ability to set kernel boot parameters can trigger an unhandled kernel page fault, leading to a denial-of-service condition during boot or runtime dcache lookups.

Affected Products

Linux kernel (mainline) prior to the fix commits
Linux kernel stable branches receiving backports 277ceda, 426ef05, 5718df1, 755b409, ddd57eb, and f08fe88
Linux distributions shipping vulnerable kernels with user-configurable dhash_entries

Discovery Timeline

2026-05-05 - CVE-2026-43071 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43071

Vulnerability Analysis

The vulnerability resides in the dcache initialization path of the Linux kernel's virtual filesystem (VFS) layer. When dhash_entries=1 is passed as a boot argument, the kernel sizes dentry_hashtable to a single bucket. The function dcache_init() derives d_hash_shift from the bucket count, producing a value of 32. This shift amount equals the operand width of the u32 value being shifted in d_hash().

Root Cause

The C standard defines right-shift operations where the shift count equals or exceeds the operand bit width as undefined behavior. Inside d_hash(), the expression dentry_hashtable + ((u32)hashlen >> d_hash_shift) does not yield zero as intuition suggests. Instead, on common x86_64 compilers, the result equals hashlen itself. The bucket pointer b therefore references memory far outside the allocated hash table region, and hlist_bl_first_rcu(head) dereferences an unmapped page during lookup [CWE-125].

Attack Vector

An attacker requires the ability to set kernel boot parameters or otherwise influence the dhash_entries value. Once the misconfigured kernel boots, any dcache lookup, including those performed by debugfs_create_dir, lookup_one_qstr_excl, and simple_start_creating, dereferences the invalid bucket address. The resulting page fault produces an Oops in __d_lookup+0x56/0x120 and halts the affected code path. The condition is reachable during early do_one_initcall execution, preventing successful boot on affected configurations.

The upstream fix enforces a minimum of two buckets in dentry_hashtable, ensuring d_hash_shift remains below 32 and the right-shift operation stays within defined behavior. See the kernel patch commit 277ceda and the kernel patch commit 426ef05 for the implementation.

Detection Methods for CVE-2026-43071

Indicators of Compromise

Kernel Oops messages referencing __d_lookup+0x56/0x120 with a supervisor read page fault at addresses outside expected slab ranges.
Boot logs containing dhash_entries=1 in the kernel command line followed by call traces involving lookup_dcache and debugfs_start_creating.
Repeated kernel panics during early initcall execution on systems with custom boot parameters.

Detection Strategies

Audit /proc/cmdline and bootloader configuration files such as /etc/default/grub for the presence of low or anomalous dhash_entries values.
Parse dmesg and journalctl -k output for page fault traces matching the __d_lookup call chain documented in the advisory.
Inventory installed kernel package versions against the fixed stable releases referenced in the upstream commits.

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized log platform and alert on BUG: unable to handle page fault events.
Track changes to bootloader configuration files using file integrity monitoring.
Correlate unexpected reboots with kernel command-line modifications across the Linux fleet.

How to Mitigate CVE-2026-43071

Immediate Actions Required

Remove dhash_entries=1 and any value lower than two from kernel boot parameters across all Linux hosts.
Apply the upstream stable kernel updates containing commits 277ceda, 426ef05, 5718df1, 755b409, ddd57eb, or f08fe88 as appropriate for the kernel branch in use.
Restrict access to bootloader configuration and physical or virtual console interfaces to prevent unauthorized parameter changes.

Patch Information

The fix limits the minimum number of dentry_hashtable buckets to two so that d_hash_shift cannot reach the bit width of u32. Distribution maintainers should backport one of the referenced commits, including the kernel patch commit 5718df1, the kernel patch commit 755b409, the kernel patch commit ddd57eb, and the kernel patch commit f08fe88.

Workarounds

Omit dhash_entries entirely from the kernel command line and let the kernel auto-size the hash table based on system memory.
If tuning is required, set dhash_entries to a value of two or greater until the patched kernel is deployed.
Use signed bootloader configurations or IMA policies to prevent tampering with kernel parameters.

bash

# Inspect current kernel command line for the unsafe parameter
cat /proc/cmdline | grep -o 'dhash_entries=[0-9]*'

# Example GRUB remediation: edit /etc/default/grub and remove dhash_entries=1
sudo sed -i 's/\bdhash_entries=1\b//g' /etc/default/grub
sudo update-grub  # or grub2-mkconfig -o /boot/grub2/grub.cfg on RHEL-based systems