CVE-2026-43374: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43374 Overview

CVE-2026-43374 is a use-after-free vulnerability [CWE-416] in the Linux kernel's nexthop subsystem, specifically in the remove_nh_grp_entry() function within net/ipv4/nexthop.c. The flaw exists in how the kernel manages percpu statistics when removing a nexthop from a group. The function frees percpu stats before the RCU grace period completes, allowing concurrent readers to dereference freed memory through nh_grp_entry_stats_inc(). Local attackers with low privileges can trigger this condition to achieve memory corruption, with potential consequences including privilege escalation, kernel information disclosure, or denial of service. The vulnerability affects Linux kernel versions from 6.9 through 7.0-rc3.

Critical Impact
Local attackers can trigger a percpu use-after-free in the kernel's network nexthop code, potentially leading to memory corruption, privilege escalation, or system crash.

Affected Products

Linux Kernel 6.9 (stable release)
Linux Kernel 7.0-rc1, 7.0-rc2, 7.0-rc3 (release candidates)
Distributions packaging affected upstream kernel versions

Discovery Timeline

2026-05-08 - CVE-2026-43374 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43374

Vulnerability Analysis

The vulnerability resides in the Linux kernel's nexthop group management code, which tracks routing nexthop entries used by the networking stack. When remove_nh_grp_entry() removes a nexthop from a group, it publishes the updated group structure using rcu_assign_pointer(), then immediately calls free_percpu() to release the removed entry's percpu statistics counters.

The ordering is incorrect. The synchronize_net() call in the caller remove_nexthop_from_groups() runs after the percpu memory has already been freed. RCU readers that entered the critical section before the pointer publish still observe the old group pointer. These readers can then dereference the freed percpu statistics through nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), accessing memory that was returned to the allocator.

Root Cause

The root cause is a violation of the RCU lifecycle contract. Memory protected by RCU must remain valid until after a grace period completes, ensuring all pre-existing readers have finished. The free_percpu() call executes synchronously inside remove_nh_grp_entry() without waiting for synchronize_net(), leaving a window where concurrent packet processing paths read freed percpu memory.

Attack Vector

Exploitation requires local access with privileges sufficient to modify nexthop group configuration, typically CAP_NET_ADMIN within a network namespace. An attacker races rapid nexthop group modifications against ongoing network traffic that triggers statistics increments. On systems exposing user namespaces, unprivileged users may obtain the required capability within an isolated namespace, broadening the attack surface.

The upstream fix defers free_percpu() until after synchronize_net() completes. Removed entries are chained on a local deferred free list via nh_list and released only after all RCU readers have exited.

Detection Methods for CVE-2026-43374

Indicators of Compromise

Unexpected kernel oops or panic messages referencing remove_nh_grp_entry, nh_grp_entry_stats_inc, or get_cpu_ptr in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free in percpu memory associated with the nexthop subsystem
Unusual frequency of nexthop group modifications by non-administrative users or containerized workloads

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to surface use-after-free conditions in the nexthop code path
Monitor ip nexthop command execution and netlink RTM_DELNEXTHOP messages for anomalous patterns from non-admin contexts
Audit kernel version inventory against the affected ranges (6.9 through 7.0-rc3) to identify exposed hosts

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging platform and alert on kernel crashes referencing networking symbols
Track creation of user namespaces with CAP_NET_ADMIN capabilities, particularly from unprivileged processes
Correlate nexthop modification netlink events with subsequent kernel instability on the same host

How to Mitigate CVE-2026-43374

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org stable commits and reboot affected systems
Identify hosts running Linux kernel 6.9 or 7.0 release candidates and prioritize them for patching
Restrict CAP_NET_ADMIN to trusted administrators and disable unprivileged user namespaces where operationally feasible

Patch Information

The fix defers free_percpu() until after synchronize_net() completes in remove_nexthop_from_groups(). The corrected sequence chains removed entries onto a local deferred free list via nh_list, then releases the percpu statistics only after the RCU grace period guarantees no readers remain. Upstream commits addressing the issue include 9e08ad731862, ab5ebab96642, abf4feaee640, and b2662e7593e9.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0 to reduce exposure from non-root attackers
Limit CAP_NET_ADMIN in container runtimes by dropping the capability from workload security contexts
Restrict access to the ip nexthop administrative interface through sudo policies and audit logging until patches are deployed

bash

# Disable unprivileged user namespaces (Debian/Ubuntu)
sysctl -w kernel.unprivileged_userns_clone=0

# Disable user namespaces broadly
sysctl -w user.max_user_namespaces=0

# Verify running kernel version against affected range
uname -r

# In Kubernetes/containers, drop CAP_NET_ADMIN in securityContext
#   capabilities:
#     drop: ["NET_ADMIN"]