CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
In the Linux kernel, the following vulnerability has been resolved:
net: nexthop: fix percpu use-after-free in removenhgrpentry
When removing a nexthop from a group, removenhgrpentry() publishes the new group via rcuassignpointer() then immediately frees the removed entry's percpu stats with freepercpu(). However, the synchronizenet() grace period in the caller removenexthopfromgroups() runs after the free. RCU readers that entered before the publish still see the old group and can dereference the freed stats via nhgrpentrystatsinc() -> getcpuptr(nhge->stats), causing a use-after-free on percpu memory.
Fix by deferring the freepercpu() until after synchronizenet() in the caller. Removed entries are chained via nhlist onto a local deferred free list. After the grace period completes and all RCU readers have finished, the percpu stats are safely freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
In remove_nh_grp_entry(), defer freeing the removed entry's percpu stats with free_percpu() until after the synchronize_net() grace period completes in the caller remove_nexthop_from_groups(); chain removed entries via nh_list on a local deferred-free list.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Linux kernel systems that use nexthop groups and remove nexthops from those groups are exposed when concurrent RCU readers can access the old group state. The affected path involves per-CPU nexthop group statistics.
What level of access does an attacker need?
The supplied severity vector indicates local access, low privileges, and no user interaction are required. It rates confidentiality, integrity, and availability impact as high.
What does the fix change to prevent the use-after-free?
The fix defers freeing the removed entry's per-CPU statistics until synchronize_net() has completed. Removed entries are kept on a deferred-free list so RCU readers of the old group cannot dereference freed memory.