CVE-2026-43374net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry When removing a nexthop from a group, remove_nh_grp_entry() publishes the new group via rcu_assign_pointer() then immediately frees the removed entry's percpu stats with free_percpu(). However, the synchronize_net() grace period in the caller remove_nexthop_from_groups() runs after the free. RCU readers that entered before the publish still see the old group and can dereference the freed stats via nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), causing a use-after-free on percpu memory. Fix by deferring the free_percpu() until after synchronize_net() in the caller. Removed entries are chained via nh_list onto a local deferred free list. After the grace period completes and all RCU readers have finished, the percpu stats are safely freed.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f4676ea74b8549cd88dbfe2a592ce4530039e61f before abf4feaee6405f1441929c6ebe7a250f2cd170a7; from f4676ea74b8549cd88dbfe2a592ce4530039e61f before ab5ebab9664214ba41a7633cb4e72f128204f924; from f4676ea74b8549cd88dbfe2a592ce4530039e61f before 9e08ad731862b22a87cc55f752e16d66cdc9e231; from f4676ea74b8549cd88dbfe2a592ce4530039e61f before b2662e7593e94ae09b1cf7ee5f09160a3612bcb2 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.9 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 6.9; 7.0; 7.0; 7.0 | NVD |
References
- https://git.kernel.org/stable/c/abf4feaee6405f1441929c6ebe7a250f2cd170a7patch
- https://git.kernel.org/stable/c/ab5ebab9664214ba41a7633cb4e72f128204f924patch
- https://git.kernel.org/stable/c/9e08ad731862b22a87cc55f752e16d66cdc9e231patch
- https://git.kernel.org/stable/c/b2662e7593e94ae09b1cf7ee5f09160a3612bcb2patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.