CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
In the Linux kernel, the following vulnerability has been resolved:
net: nexthop: fix percpu use-after-free in removenhgrpentry
When removing a nexthop from a group, removenhgrpentry() publishes the new group via rcuassignpointer() then immediately frees the removed entry's percpu stats with freepercpu(). However, the synchronizenet() grace period in the caller removenexthopfromgroups() runs after the free. RCU readers that entered before the publish still see the old group and can dereference the freed stats via nhgrpentrystatsinc() -> getcpuptr(nhge->stats), causing a use-after-free on percpu memory.
Fix by deferring the freepercpu() until after synchronizenet() in the caller. Removed entries are chained via nhlist onto a local deferred free list. After the grace period completes and all RCU readers have finished, the percpu stats are safely freed.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Linux kernel systems that use nexthop groups and remove nexthops from those groups are exposed when concurrent RCU readers can access the old group state. The affected path involves per-CPU nexthop group statistics.
What level of access does an attacker need?
The supplied severity vector indicates local access, low privileges, and no user interaction are required. It rates confidentiality, integrity, and availability impact as high.
What does the fix change to prevent the use-after-free?
The fix defers freeing the removed entry's per-CPU statistics until synchronize_net() has completed. Removed entries are kept on a deferred-free list so RCU readers of the old group cannot dereference freed memory.