Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system hang or resource exhaustion. The issue occurs when certain network interface hardware offloading features are used and then disabled or removed, preventing the system from properly cleaning up internal references. This can lead to a situation where the system cannot fully unregister network devices, potentially impacting network availability and system stability.
Technical details
A reference count leak exists in the Linux kernel XFRM subsystem due to improper handling of the NETDEV_UNREGISTER event. The vulnerability stems from xfrm_dev_state_add() acquiring a reference to a 'net_device' structure that is not always released if the NETIF_F_HW_ESP feature bit is cleared before the device is removed. Previously, the kernel shared the same handler for both NETDEV_DOWN and NETDEV_UNREGISTER events, which failed to account for cases where hardware offloading was disabled. An attacker with local access can trigger this by adding an XFRM state with crypto offload and then disabling the offload before deleting the device, causing the net_device reference count to remain non-zero and preventing the device from being freed. This has been fixed by re-introducing a dedicated xfrm_dev_unregister() function that unconditionally flushes state and policy.
Affected products
- Linux Linux kernel 4.12 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-30: patched: Initial patch authored
- 2026-05-06: advisory: CVE-2026-43167 published
References
- https://git.kernel.org/stable/c/166801e49a5b5fc127b8c9e2f110f303cfddfbc3
- https://git.kernel.org/stable/c/4efa91a28576054aae0e6dad9cba8fed8293aef8
- https://git.kernel.org/stable/c/59581778792cbaf8ad788f4a21dc663ce986050e
- https://git.kernel.org/stable/c/8c75c455ecd3bfd2f36abf66edb7021c4fa19ec4
- https://git.kernel.org/stable/c/a3c8fede034fa27892f87c863cbd5493167d17ed