Executive brief
A vulnerability in the Linux kernel's thread management system could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when certain background processes (kthreads) exit improperly, leaving behind corrupted memory that can be exploited. This could lead to a complete loss of system availability or the compromise of sensitive data handled by the operating system.
Technical details
A use-after-free vulnerability exists in the Linux kernel's kthread implementation due to inconsistent exit paths. When a kthread exits via make_task_dead(), it bypasses the standard kthread_exit() path, failing to perform necessary cleanup for the affinity_node. This leaves the node linked in the global kthread_affinity_list after the underlying memory has been freed. Because struct kthread and struct pid can share the same slab cache and memory offsets (specifically offset 0x78), a subsequent list_del() operation by another thread can overwrite the rcu.func pointer in a reused struct pid. This memory corruption can be triggered remotely if network-facing services utilize affected kthread operations, leading to arbitrary code execution or kernel panics. The fix consolidates exit paths by introducing kthread_do_exit() within the main do_exit() flow to ensure cleanup occurs regardless of the exit method.
Affected products
- Linux Linux Kernel 6.14 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2
Timeline
- 2026-02-26: patched: Initial fix committed to mainline kernel
- 2026-05-08: disclosed: CVE-2026-43402 published
- 2026-05-08: advisory