CVE-2026-43374 net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
A use-after-free in the Linux kernel's nexthop group removal allows attackers to potentially execute code or escalate privileges via race conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43374?
CVE-2026-43374 is a high-severity use after free vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
When removing a nexthop from a group, remove_nh_grp_entry() publishes the new group via rcu_assign_pointer() then immediately frees the removed entry's percpu stats with free_percpu(). However, the synchronize_net() grace period in the caller remove_nexthop_from_groups() runs after the free. RCU readers that entered before the publish still see the old group and can dereference the freed stats via nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), causing a use-after-free on percpu memory.
Fix by deferring the free_percpu() until after synchronize_net() in the caller. Removed entries are chained via nh_list onto a local deferred free list. After the grace period completes and all RCU readers have finished, the percpu stats are safely freed.
Weakness: CWE-416
Which versions are affected by CVE-2026-43374?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43374?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-43374 being exploited?
There is no known exploitation of CVE-2026-43374 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43374, DEBIAN-CVE-2026-43374, GHSA-4gvv-jqvc-49j6, UBUNTU-CVE-2026-43374.