CVE Explorer

CVE-2026-43091

In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first. The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU gra

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:13aac37fe4ea292bbed437820796bf68ba7febf3a3d5d88a251c4b76979a5725

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b66920a3348c0f63ba18365248fa21fbf0b3a937","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"438b1f668ad58f46ce699bb48e4698a7839e3f9e","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"3733fce2871c9bca9dd18a1a23b1432ea215a094","status":"affected","version":"e1e551bc56302b80ff930c9…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOr…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/metrics/0/cvssV3_1

Source references

5 source assertions

{"url":"https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9e"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:42959c406ac6817de5eed84f71f0bf626e1b12299223cf3dc1a766d7329449bd · sha256:5f7a4a1e60c04542… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer