CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Wait for RCU readers during policy netns exit
xfrmpolicyfini() frees the policybydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first.
The policybydst tables are published via rcuassignpointer() and are looked up through rcudereferencecheck(), so netns teardown must also wait for an RCU grace period before freeing the table memory.
Fix this by adding synchronizercu() before freeing the policy hash tables.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The supplied CVSS vector indicates local access, low attack complexity, and low privileges required. No user interaction is required.
What conditions make a system exposed?
Exposure involves Linux kernel XFRM policy network-namespace teardown occurring while concurrent RCU readers are still accessing the published policy_bydst hash tables. The vulnerability is a use-after-free condition caused by freeing those tables without first waiting for an RCU grace period.
How is the issue fixed?
The fix adds synchronize_rcu() during xfrm_policy_fini() before the policy hash tables are freed. This waits for concurrent RCU read-side critical sections to complete before their memory is released.