CVE-2026-43339: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43339 Overview

CVE-2026-43339 is a use-after-free vulnerability [CWE-416] in the Linux kernel's IPv6 networking stack. The flaw resides in the addrconf_permanent_addr() helper function, which emits a warning about an exceptional condition after the underlying IPv6 address structure may have already been deleted. The late access to freed memory creates a use-after-free condition exploitable by local users.

The issue affects multiple Linux kernel versions including 7.0 release candidates rc1 through rc7. The fix reorders the relevant statements to access the IPv6 data before deletion and moves the warning outside the idev->lock since it requires no protection.

Critical Impact

Local attackers with low privileges can trigger memory corruption in the kernel's IPv6 subsystem, potentially leading to privilege escalation, denial of service, or arbitrary code execution in kernel context.

Affected Products

• Linux Kernel (multiple stable branches)
• Linux Kernel 7.0-rc1 through 7.0-rc7
• Distributions shipping vulnerable upstream kernels

Discovery Timeline

• 2026-05-08 - CVE-2026-43339 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43339

Vulnerability Analysis

The vulnerability is a use-after-free condition in the IPv6 address configuration code path. The addrconf_permanent_addr() helper attempts to warn the user about an exceptional condition relating to permanent IPv6 addresses on a device. The warning message dereferences the IPv6 address structure after the structure may have already been removed from the device's address list and freed.

The kernel's address resolution logic for IPv6 protocols iterates over interface address entries while holding idev->lock. The ordering bug causes the warning code to read fields from the address object after a possible deletion path runs. Reading freed memory in kernel context produces undefined behavior, including kernel oops, data corruption, and exploitable memory access primitives.

Root Cause

The root cause is incorrect statement ordering in addrconf_permanent_addr(). The diagnostic warning was emitted too late in the execution flow, after operations that may delete the IPv6 address object. The patch reorders statements so that any data needed for the warning is captured before the deletion, and the warning itself is moved outside the idev->lock because it does not require lock protection.

Attack Vector

A local user with the ability to configure network interfaces or trigger IPv6 address state transitions can force the kernel into the exceptional code path. Repeated or carefully timed interface configuration operations can produce a reliable use-after-free window. Exploitation requires only local access and low privileges, with no user interaction needed.

The vulnerability mechanism is described in the upstream commits referenced in the Linux Kernel mainline changelog. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-43339

Indicators of Compromise

• Kernel oops or panic messages referencing addrconf_permanent_addr or related IPv6 address configuration functions
• KASAN (Kernel Address Sanitizer) reports flagging use-after-free in net/ipv6/addrconf.c
• Unexpected kernel warnings or stack traces tied to IPv6 interface state changes
• Anomalous local processes performing repeated IPv6 address add/remove operations

Detection Strategies

• Enable KASAN on test and staging kernels to surface use-after-free conditions during fuzzing or workload simulation
• Monitor dmesg and /var/log/kern.log for warnings emitted from the IPv6 stack
• Audit auditd records for unprivileged processes invoking ioctl or netlink calls that manipulate interface addresses
• Correlate kernel crash dumps with running processes that hold CAP_NET_ADMIN or interact with network namespaces

Monitoring Recommendations

• Forward kernel logs to a centralized SIEM and alert on crash signatures involving ipv6 and addrconf
• Track frequency of netlink RTM_NEWADDR and RTM_DELADDR events per process to detect abuse patterns
• Baseline normal IPv6 address churn on production hosts and alert on deviations

How to Mitigate CVE-2026-43339

Immediate Actions Required

• Identify all Linux hosts running affected kernel versions, including 7.0 release candidates and earlier stable branches
• Apply vendor-provided kernel updates that include the upstream fix as soon as they are available for your distribution
• Restrict local shell access on multi-tenant systems where untrusted users may attempt privilege escalation
• Validate that container hosts and Kubernetes nodes are running patched kernels, since container escape paths often rely on kernel flaws

Patch Information

The fix is committed to the upstream Linux kernel and backported across multiple stable branches. The change reorders statements in addrconf_permanent_addr() to avoid accessing the IPv6 address structure after potential deletion, and relocates the warning outside idev->lock. Refer to the upstream stable commit and the additional backport commits listed in the NVD references. Distribution maintainers including Debian, Ubuntu, Red Hat, and SUSE issue corresponding security updates through their package repositories.

Workarounds

• Limit CAP_NET_ADMIN capability and restrict creation of user network namespaces by setting kernel.unprivileged_userns_clone=0 where supported
• Disable IPv6 on systems that do not require it by setting net.ipv6.conf.all.disable_ipv6=1 if operationally acceptable
• Use seccomp or AppArmor profiles to block unnecessary netlink interface configuration calls from untrusted processes

# Configuration example: restrict unprivileged user namespaces and check kernel version
sudo sysctl -w kernel.unprivileged_userns_clone=0
uname -r
# Optional: disable IPv6 if not required
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1