CVE-2026-43115: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43115 Overview

CVE-2026-43115 is a Linux kernel vulnerability in the Tiny Sleepable Read-Copy-Update (SRCU) subsystem. The flaw resides in srcu_gp_start_if_needed(), which directly calls schedule_work() and acquires the workqueue pool->lock. When call_srcu() runs while a scheduler lock such as pi_lock is held, lockdep detects an inverse lock ordering against workqueue_init() and create_worker(). The same patch also addresses a potential use-after-free in cleanup_srcu_struct() when a queued irq_work fires after cleanup begins. The fix routes grace period (GP) initiation through an intermediate irq_work and adds irq_work_sync() during cleanup.

Critical Impact
Improper lock ordering in Tiny SRCU can trigger lockdep splats and a use-after-free if a queued irq_work fires after cleanup_srcu_struct() begins.

Affected Products

Linux kernel builds configured with Tiny SRCU (CONFIG_TINY_SRCU)
Stable kernel branches receiving the referenced commits
Downstream distributions tracking the upstream stable tree

Discovery Timeline

2026-05-06 - CVE-2026-43115 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43115

Vulnerability Analysis

Tiny SRCU is the lightweight variant of SRCU used on uniprocessor or constrained kernel builds. Its srcu_gp_start_if_needed() function schedules deferred work using schedule_work() to begin a new grace period. schedule_work() acquires the workqueue pool->lock internally. Callers of call_srcu() may already hold scheduler locks such as pi_lock, producing a lock chain pi_lock -> pool->lock. The reverse chain occurs during workqueue_init() and create_worker(), where pool->lock is held while wake_up_process() ultimately acquires pi_lock. Lockdep flags this as a potential deadlock. A second issue arises in cleanup_srcu_struct(): a previously queued irq_work can fire after the SRCU structure begins teardown, dereferencing freed memory.

Root Cause

The root cause is direct invocation of schedule_work() from a context where higher-level scheduler locks are held, combined with missing synchronization of pending irq_work items at SRCU teardown. The cleanup path did not call irq_work_sync(), leaving a window for late-firing work to operate on a torn-down structure.

Attack Vector

Reaching this code path requires kernel context: a caller that invokes call_srcu() while holding scheduler locks. The condition is primarily a correctness and stability defect rather than a remotely reachable attack surface. Local triggering via kernel paths that exercise SRCU under contended scheduler locks can produce instability or, in the cleanup race, memory corruption through use-after-free.

The vulnerability is described in prose because no public proof-of-concept code is referenced. Refer to the Kernel Git Commit Update and Kernel Git Commit Change for the upstream resolution.

Detection Methods for CVE-2026-43115

Indicators of Compromise

Lockdep splats in kernel logs referencing pi_lock, pool->lock, and srcu_gp_start_if_needed
Kernel oops or panic traces tied to SRCU callbacks executing after cleanup_srcu_struct()
rcutorture SRCU-T runs producing warnings on unpatched kernels

Detection Strategies

Enable CONFIG_PROVE_LOCKING and CONFIG_DEBUG_LOCK_ALLOC on test builds to surface the inverse lock ordering
Run the in-tree rcutorture SRCU-T scenario as a regression check before deployment
Compare running kernel commit identifiers against the patched stable commits a6fc88b22bc8 and bb37286db653

Monitoring Recommendations

Forward dmesg and journald kernel records to a centralized log store and alert on WARNING: and BUG: entries originating from kernel/rcu/srcutiny.c
Track kernel package versions across the fleet and flag hosts running Tiny SRCU builds prior to the fix
Monitor for unexpected kernel restarts on systems with CONFIG_TINY_SRCU enabled

How to Mitigate CVE-2026-43115

Immediate Actions Required

Apply the upstream fix that introduces an intermediate irq_work for starting grace periods in Tiny SRCU
Rebuild and redeploy custom kernels that enable CONFIG_TINY_SRCU after merging the referenced commits
Update to a stable kernel release that includes commits a6fc88b22bc8 and bb37286db653

Patch Information

The upstream resolution replaces the direct schedule_work() call in srcu_gp_start_if_needed() with an irq_work indirection that defers the workqueue interaction to a safe context. It also adds irq_work_sync() to cleanup_srcu_struct() to guarantee no queued irq_work fires after teardown. See the Kernel Git Commit Update and Kernel Git Commit Change.

Workarounds

Where feasible, build kernels with full Tree SRCU instead of CONFIG_TINY_SRCU until patches are deployed
Avoid invoking call_srcu() from contexts that hold scheduler locks such as pi_lock in out-of-tree modules
Pin affected systems to known-good stable kernels until the fix is integrated

bash

# Verify whether the running kernel includes the fix
git -C /usr/src/linux log --oneline | grep -E "a6fc88b22bc8|bb37286db653"

# Check for Tiny SRCU configuration in the running kernel
zcat /proc/config.gz 2>/dev/null | grep -E "CONFIG_TINY_SRCU|CONFIG_TREE_SRCU"