Is CVE-2026-43402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43402 being exploited in the wild.

How severe is CVE-2026-43402?

Critical severity, with a CVSS score of 9.8, published 8 May 2026.

Which products and versions are affected?

Linux Kernel All versions prior to the fix in 2026-02-26.

Is there a fix for CVE-2026-43402?

A patch was published on 2026-02-26: Initial fix committed to mainline kernel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43402 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-43402?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43402: Linux Kernel use-after-free in kthread exit paths

CVE-2026-43402 · Severity: critical · CVSS 9.8 · Published 2026-05-08

A vulnerability in the Linux kernel's thread management system could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when certain background processes (kthreads) exit improperly, leaving behind corrupted memory that can be exploited. This could lead to a complete loss of system availability or the compromise of sensitive data handled by the operating system.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-43402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43402 being exploited in the wild.
How severe is CVE-2026-43402?: Critical severity, with a CVSS score of 9.8, published 8 May 2026.
Which products and versions are affected?: Linux Kernel All versions prior to the fix in 2026-02-26.
Is there a fix for CVE-2026-43402?: A patch was published on 2026-02-26: Initial fix committed to mainline kernel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43402 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-43402?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the Linux kernel's kthread implementation due to inconsistent exit paths. When a kthread exits via make_task_dead(), it bypasses the standard kthread_exit() path, failing to perform necessary cleanup for the affinity_node. This leaves the node linked in the global kthread_affinity_list after the underlying memory has been freed. Because struct kthread and struct pid can share the same slab cache and memory offsets (specifically offset 0x78), a subsequent list_del() operation by another thread can overwrite the rcu.func pointer in a reused struct pid. This memory corruption can be triggered remotely if network-facing services utilize affected kthread operations, leading to arbitrary code execution or kernel panics. The fix consolidates exit paths by introducing kthread_do_exit() within the main do_exit() flow to ensure cleanup occurs regardless of the exit method.

Affected products

Linux Linux Kernel 6.14 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2

Timeline

2026-02-26: patched: Initial fix committed to mainline kernel
2026-05-08: disclosed: CVE-2026-43402 published
2026-05-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.