CVE-2026-43167: Linux Kernel Privilege Escalation Flaw

CVE-2026-43167 Overview

CVE-2026-43167 is a Linux kernel vulnerability in the xfrm (IPsec transformation) subsystem. The flaw causes a struct net_device reference count leak when a network device is unregistered while IPsec hardware offload state remains attached. The function xfrm_dev_state_add() in net/xfrm/xfrm_device.c acquires a netdev_tracker reference, but xfrm_dev_unregister() was implemented as a no-op. As a result, unregister_netdevice blocks indefinitely, waiting for the device to become free. The issue was reproduced by syzbot and Sabrina Dubroca using netdevsim with esp-hw-offload toggled off after state creation.

Critical Impact
A local user with CAP_NET_ADMIN can pin network device references and prevent device teardown, leading to a persistent denial of service in the kernel networking stack.

Affected Products

Linux kernel versions containing commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API")
Linux kernel versions containing commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device")
Stable kernel branches prior to fix commits 166801e, 4efa91a, 5958177, 8c75c45, and a3c8fed

Discovery Timeline

2026-05-06 - CVE-2026-43167 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43167

Vulnerability Analysis

The vulnerability resides in the kernel's IPsec transformation framework, specifically in how xfrm manages references to struct net_device during hardware offload. When a user adds an IPsec state with offload crypto dev <dev> dir out, xfrm_dev_state_add() calls netdev_tracker_alloc() to pin the underlying network device. The xfrm_dev_unregister() handler, however, performed no cleanup, assuming NETDEV_DOWN would always precede NETDEV_UNREGISTER and that the NETIF_F_HW_ESP feature bit would remain set.

Neither assumption holds. Administrators can clear NETIF_F_HW_ESP via ethtool -K <dev> esp-hw-offload off after state creation. Once cleared, the down/unregister event handler in xfrm_dev_event() skips the cleanup path because it gates flushing on the offload feature bit, leaving the held reference dangling.

Root Cause

The root cause is asymmetric reference handling between acquisition and release. xfrm_dev_state_add() acquires a reference to struct net_device unconditionally, without checking NETIF_F_HW_ESP. The release path, shared between NETDEV_DOWN and NETDEV_UNREGISTER via xfrm_dev_down(), conditionally skips state and policy flushing. This creates a memory leak [CWE-401] and resource lifecycle violation that prevents the netdev unregister machinery from completing.

Attack Vector

The attack vector requires local privileged access with CAP_NET_ADMIN to manipulate xfrm state and netdev features. The reproduction sequence involves creating a netdevsim device, adding an xfrm state with hardware crypto offload pointing at that device, disabling esp-hw-offload via ethtool, and then deleting the device. The kernel logs unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2 and the device cannot be torn down. Repeated triggering exhausts kernel resources and degrades networking subsystem availability.

The fix re-introduces an explicit xfrm_dev_unregister() path that unconditionally flushes state and policy on NETDEV_UNREGISTER, regardless of the current state of NETIF_F_HW_ESP. See the Kernel Git Commit a3c8fed for the upstream fix.

Detection Methods for CVE-2026-43167

Indicators of Compromise

Kernel log messages containing unregister_netdevice: waiting for <dev> to become free. Usage count = N that persist across multiple polling intervals.
ref_tracker stack traces in dmesg referencing xfrm_dev_state_add and netdev_tracker_alloc.
Network interfaces stuck in an unregistering state visible via ip link show or /sys/class/net/.

Detection Strategies

Monitor /var/log/kern.log and dmesg output for repeated unregister_netdevice warnings tied to interfaces that previously had IPsec offload configured.
Audit xfrm state and policy tables with ip xfrm state and ip xfrm policy to identify entries referencing offload devices.
Correlate ethtool -K feature toggles on offload-capable NICs with subsequent xfrm state lifecycle events.

Monitoring Recommendations

Collect kernel logs into a centralized log pipeline and alert on the unregister_netdevice: waiting for substring.
Track netdev reference counts via ref_tracker debugfs entries on kernels built with CONFIG_NET_DEV_REFCNT_TRACKER.
Baseline expected xfrm offload usage on production hosts and flag deviations or feature toggles outside change windows.

How to Mitigate CVE-2026-43167

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 166801e, 4efa91a, 5958177, 8c75c45, and a3c8fed to all affected hosts.
Restrict CAP_NET_ADMIN to trusted administrators and audit users with the capability on multi-tenant systems.
Avoid toggling esp-hw-offload on interfaces with active xfrm states until patched kernels are deployed.

Patch Information

The fix re-introduces xfrm_dev_unregister() to unconditionally flush xfrm state and policy on NETDEV_UNREGISTER, releasing the held struct net_device reference. Patches are available across stable trees: Kernel Git Commit 166801e, Kernel Git Commit 4efa91a, Kernel Git Commit 5958177, Kernel Git Commit 8c75c45, and Kernel Git Commit a3c8fed.

Workarounds

Disable IPsec hardware offload on affected hosts by ensuring NETIF_F_HW_ESP is not used and configuring software-only IPsec until patches are deployed.
Manually flush xfrm state and policy with ip xfrm state flush and ip xfrm policy flush before unregistering or removing offload-capable interfaces.
Limit access to netdevsim and similar test interfaces in production environments by removing the module or restricting /sys/bus/netdevsim/ access.

bash

# Configuration example: flush xfrm state/policy before removing an offload device
ip xfrm state flush
ip xfrm policy flush
ethtool -K eth0 esp-hw-offload off
ip link set eth0 down