CVE-2026-43090: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43090 Overview

CVE-2026-43090 is a memory leak vulnerability in the Linux kernel's xfrm (IPsec transform) subsystem. The flaw resides in the xfrm_migrate_policy_find() function within net/xfrm/xfrm_policy.c, where a redundant call to xfrm_pol_hold_rcu() causes a reference count imbalance. The lookup function already returns a policy with a held reference, so the additional hold prevents proper deallocation of xfrm_policy structures. Syzkaller, run by the Linux Verification Center (linuxtesting.org), discovered the issue and reported the leak through xfrm_policy_alloc+0xb3/0x4b0. Repeated invocation of the affected code path exhausts kernel memory over time.

Critical Impact
Sustained exercise of the IPsec policy migration path leaks 1024-byte xfrm_policy allocations, gradually depleting kernel memory and degrading system stability.

Affected Products

Linux kernel versions containing the unfixed xfrm_migrate_policy_find() implementation
Stable kernel branches prior to the commits referenced in the kernel.org git tree
Distributions packaging affected upstream kernels with IPsec/XFRM enabled

Discovery Timeline

2026-05-06 - CVE-2026-43090 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43090

Vulnerability Analysis

The xfrm subsystem implements IPsec policy and state management in the Linux kernel. The xfrm_migrate_policy_find() function locates an existing policy when migrating IPsec security associations between endpoints. Internally, the lookup helper increments the policy reference count via xfrm_pol_hold_rcu() before returning the policy pointer. The buggy code path then calls xfrm_pol_hold_rcu() a second time on the same policy. Each migration request therefore raises the reference count by two but releases it only once. The policy object never reaches a zero refcount and remains pinned in memory after the caller is done with it.

Root Cause

The defect is a refcount accounting error [CWE-401: Missing Release of Memory after Effective Lifetime]. The caller assumed the lookup did not take a reference and added its own hold. Because the lookup already returned a held reference, the redundant xfrm_pol_hold_rcu() produces a permanent imbalance. Syzkaller's kmemleak instrumentation observed the unreferenced 1024-byte allocations originating from xfrm_policy_alloc().

Attack Vector

A local user with the capability to invoke IPsec policy migration operations through the XFRM netlink interface can repeatedly trigger the leaking code path. Each invocation consumes a xfrm_policy allocation that is never freed. Sustained activity exhausts kernel slab memory, producing degraded performance and potential denial of service. Exploitation requires the privileges normally needed to manipulate IPsec policies, typically CAP_NET_ADMIN within an appropriate namespace.

No public proof-of-concept beyond the syzkaller reproducer is referenced in the advisory. The vulnerability is described in prose because no verified exploitation code is published with the CVE.

Detection Methods for CVE-2026-43090

Indicators of Compromise

Kernel kmemleak reports listing unreferenced 1024-byte objects allocated by xfrm_policy_alloc+0xb3/0x4b0
Steady growth in the xfrm_policy slab cache visible in /proc/slabinfo without a corresponding rise in active IPsec policies
Increasing Slab and SUnreclaim values in /proc/meminfo on hosts running IPsec migration workloads

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and review /sys/kernel/debug/kmemleak for xfrm_policy_alloc stack traces
Audit netlink traffic on NETLINK_XFRM for repeated XFRM_MSG_MIGRATE requests originating from unexpected processes
Correlate kernel memory pressure events with workloads that exercise the IPsec migration path

Monitoring Recommendations

Track kernel slab metrics over time and alert on abnormal growth in xfrm_policy and related caches
Log CAP_NET_ADMIN usage and xfrm netlink operations for forensic review
Monitor host availability and OOM events on IPsec gateways and VPN concentrators

How to Mitigate CVE-2026-43090

Immediate Actions Required

Apply the upstream kernel patches referenced under the stable git commits 21e235a3, 70c2a89a, 83317cce, and 836ee1b0
Rebuild and deploy distribution kernels that incorporate the corrected xfrm_migrate_policy_find() logic
Restrict CAP_NET_ADMIN and access to the XFRM netlink interface to trusted administrators only

Patch Information

The fix removes the redundant xfrm_pol_hold_rcu() call inside xfrm_migrate_policy_find(), restoring correct reference counting. The change is available in the mainline and stable trees through the following commits: 21e235a36cfb, 70c2a89a3bc2, 83317cce60a0, and 836ee1b0426e.

Workarounds

Disable IPsec policy migration where it is not operationally required
Use Linux capability bounding sets and namespace isolation to deny untrusted workloads access to XFRM netlink
Schedule periodic reboots of affected IPsec gateways to reclaim leaked memory until patches are applied

bash

# Verify the running kernel includes the fix commit
uname -r
grep -E 'xfrm_migrate_policy_find' /proc/kallsyms

# Restrict XFRM netlink access using a non-root namespace
unshare --net --user --map-root-user /bin/bash

# Inspect xfrm_policy slab usage for leak indicators
grep xfrm_policy /proc/slabinfo