CVE-2026-43402: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43402 Overview

CVE-2026-43402 is a use-after-free vulnerability in the Linux kernel kthread subsystem. The flaw stems from inconsistent kthread exit paths where make_task_dead() bypasses kthread_exit(), missing the affinity_node cleanup. When free_kthread_struct() releases memory while the node remains linked in the global kthread_affinity_list, a subsequent list_del() by another kthread writes through dangling list pointers into freed and reused memory. This corruption was traced through KUnit testing when reused slab memory belonged to a struct pid, leading to corrupted Read-Copy-Update (RCU) callback function pointers.

Critical Impact
Memory corruption through dangling list pointers can corrupt RCU callback function pointers in reused slab memory, enabling potential kernel-level code execution or system crashes.

Affected Products

Linux kernel versions prior to the consolidated kthread exit path fix
Kernels built with CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN
Kernels without CONFIG_BLK_CGROUP where struct kthread is 144 bytes

Discovery Timeline

2026-05-08 - CVE-2026-43402 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43402

Vulnerability Analysis

The vulnerability arises from a slab cache aliasing condition combined with incomplete kthread cleanup. The pidfs rhashtable conversion replaced the 24-byte rb_node with an 8-byte rhash_head in struct pid, shrinking it from 160 to 144 bytes. Because struct kthread without CONFIG_BLK_CGROUP is also 144 bytes, and both CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN round these allocations up to 192 bytes, the two structures share the same slab cache.

When the shared allocation is reused, struct pid.rcu.func and struct kthread.affinity_node both sit at offset 0x78. A stale list operation on the freed kthread therefore writes directly into the RCU callback function pointer of a live struct pid. When that callback later fires, the kernel transfers control to an attacker-influenced address.

Root Cause

Kernel threads can terminate through multiple paths. kthread_exit() performs the required cleanup, but make_task_dead() and direct do_exit() invocations skip the kthread-specific teardown. The affinity_node for the terminating kthread remains linked in kthread_affinity_list even after free_kthread_struct() releases the backing memory.

Attack Vector

An attacker requires a code path that causes a kernel thread to exit via make_task_dead() rather than kthread_exit(). After the kthread structure is freed and the slab slot is reallocated as a struct pid, another kthread iterating the affinity list issues a list_del() that overwrites the new occupant's rcu.func pointer. The corrupted function pointer is invoked during RCU callback processing, hijacking kernel control flow.

The upstream fix consolidates exit paths by converting kthread_exit() into a macro that calls do_exit() and adds kthread_do_exit(), which do_exit() invokes for any task with PF_KTHREAD set. A new tsk_is_kthread() accessor replaces __to_kthread() in the public header.

Detection Methods for CVE-2026-43402

Indicators of Compromise

Kernel oops or panic logs referencing corrupted RCU callback function pointers during rcu_do_batch() or rcu_core()
Unexpected control transfers from RCU softirq context to non-callback addresses
KASAN reports flagging use-after-free in kthread_affinity_list operations or list_del() on freed struct kthread

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_LIST on test kernels to surface dangling list pointer writes
Inventory running kernels and match build versions against the patched commits 28aaa9c39945, 4729c7b00a34, and 5a591d7a5e48
Review crash dumps for slab cache collisions between struct pid and struct kthread allocations at the 192-byte size class

Monitoring Recommendations

Forward kernel ring buffer and dmesg output to a centralized log pipeline for anomaly review
Alert on repeated kernel panics or RCU stall warnings across fleet hosts
Track unexpected reboots on systems running kernels that have not yet received the consolidated exit path patch

How to Mitigate CVE-2026-43402

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 28aaa9c39945, 4729c7b00a34, and 5a591d7a5e48
Update to distribution kernels that incorporate the consolidated kthread exit path fix
Reboot affected systems after kernel updates to load the patched image

Patch Information

The fix is published in the Linux stable tree. See the Kernel Git Commit Patch, Kernel Git Commit Fix, and Kernel Git Commit Update. The patch consolidates all kthread exit paths so cleanup runs regardless of whether termination occurs through make_task_dead(), direct do_exit(), or kthread_exit().

Workarounds

Build kernels without CONFIG_SLAB_MERGE_DEFAULT to prevent slab cache aliasing between struct pid and struct kthread
Enable CONFIG_BLK_CGROUP to change struct kthread size and avoid the 192-byte slab collision
Restrict local access to systems running unpatched kernels until updates are deployed

bash

# Verify kernel version and confirm patch presence
uname -r
grep -r "kthread_do_exit" /usr/src/linux/kernel/
# Disable slab merging at boot to mitigate cross-cache reuse
# Add to kernel command line: slab_nomerge