# CVE-2026-43402: Linux Kernel use-after-free in kthread exit paths

Source: https://junglewise.ai/threats/cve-2026-43402-linux-kernel-use-after-free-in-kthread-exit-paths  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-43402 · Severity: critical · CVSS 9.8 · Published 2026-05-08

A vulnerability in the Linux kernel's thread management system could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when certain background processes (kthreads) exit improperly, leaving behind corrupted memory that can be exploited. This could lead to a complete loss of system availability or the compromise of sensitive data handled by the operating system.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-43402 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43402 being exploited in the wild.

**How severe is CVE-2026-43402?** Critical severity, with a CVSS score of 9.8, published 8 May 2026.

**Which products and versions are affected?** Linux Kernel All versions prior to the fix in 2026-02-26.

**Is there a fix for CVE-2026-43402?** A patch was published on 2026-02-26: Initial fix committed to mainline kernel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43402 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-43402?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the Linux kernel's kthread implementation due to inconsistent exit paths. When a kthread exits via make_task_dead(), it bypasses the standard kthread_exit() path, failing to perform necessary cleanup for the affinity_node. This leaves the node linked in the global kthread_affinity_list after the underlying memory has been freed. Because struct kthread and struct pid can share the same slab cache and memory offsets (specifically offset 0x78), a subsequent list_del() operation by another thread can overwrite the rcu.func pointer in a reused struct pid. This memory corruption can be triggered remotely if network-facing services utilize affected kthread operations, leading to arbitrary code execution or kernel panics. The fix consolidates exit paths by introducing kthread_do_exit() within the main do_exit() flow to ensure cleanup occurs regardless of the exit method.

## Affected products

- Linux Linux Kernel 6.14 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2

## Timeline

- 2026-02-26: patched: Initial fix committed to mainline kernel
- 2026-05-08: disclosed: CVE-2026-43402 published
- 2026-05-08: advisory

## References

- [https://git.kernel.org/stable/c/28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f](https://git.kernel.org/stable/c/28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f)
- [https://git.kernel.org/stable/c/4729c7b00a347fd37d0cbc265b85f2884c3e06b6](https://git.kernel.org/stable/c/4729c7b00a347fd37d0cbc265b85f2884c3e06b6)
- [https://git.kernel.org/stable/c/5a591d7a5e48d30100943940a30a6ab41b15c672](https://git.kernel.org/stable/c/5a591d7a5e48d30100943940a30a6ab41b15c672)

## Related threats

- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel PMC uninitialized clock rate in 32-bit Tegra](https://junglewise.ai/threats/cve-2026-99259-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel x86 Hyper-V memory access violation](https://junglewise.ai/threats/cve-2026-99258-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel io_uring signal loss in worker exit](https://junglewise.ai/threats/cve-2026-99228-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel mv643xx_eth NULL pointer dereference in PHY probe](https://junglewise.ai/threats/cve-2026-99197-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)