GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43385 (GCVE-0-2026-43385)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-08-05 12:27
VLAI
Title
net: Fix rcu_tasks stall in threaded busypoll
Summary
In the Linux kernel, the following vulnerability has been resolved: net: Fix rcu_tasks stall in threaded busypoll I was debugging a NIC driver when I noticed that when I enable threaded busypoll, bpftrace hangs when starting up. dmesg showed: rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 10658 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 40793 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 131273 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 402058 jiffies old. INFO: rcu_tasks detected stalls on tasks: 00000000769f52cd: .N nvcsw: 2/2 holdout: 1 idle_cpu: -1/64 task:napi/eth2-8265 state:R running task stack:0 pid:48300 tgid:48300 ppid:2 task_flags:0x208040 flags:0x00004000 Call Trace: <TASK> ? napi_threaded_poll_loop+0x27c/0x2c0 ? __pfx_napi_threaded_poll+0x10/0x10 ? napi_threaded_poll+0x26/0x80 ? kthread+0xfa/0x240 ? __pfx_kthread+0x10/0x10 ? ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ? ret_from_fork_asm+0x1a/0x30 </TASK> The cause is that in threaded busypoll, the main loop is in napi_threaded_poll rather than napi_threaded_poll_loop, where the latter rarely iterates more than once within its loop. For rcu_softirq_qs_periodic inside napi_threaded_poll_loop to report its qs state, the last_qs must be 100ms behind, and this can't happen because napi_threaded_poll_loop rarely iterates in threaded busypoll, and each time napi_threaded_poll_loop is called last_qs is reset to latest jiffies. This patch changes so that in threaded busypoll, last_qs is saved in the outer napi_threaded_poll, and whether busy_poll_last_qs is NULL indicates whether napi_threaded_poll_loop is called for busypoll. This way last_qs would not reset to latest jiffies on each invocation of napi_threaded_poll_loop.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c18d4b190a46651726c9a952667c74d2deb33c28 , < 52459201d0df3fdbb1d281738b7b772e2cacb49c (git)
Affected: c18d4b190a46651726c9a952667c74d2deb33c28 , < 1a86a1f7d88996085934139fa4c063b6299a2dd3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "52459201d0df3fdbb1d281738b7b772e2cacb49c",
              "status": "affected",
              "version": "c18d4b190a46651726c9a952667c74d2deb33c28",
              "versionType": "git"
            },
            {
              "lessThan": "1a86a1f7d88996085934139fa4c063b6299a2dd3",
              "status": "affected",
              "version": "c18d4b190a46651726c9a952667c74d2deb33c28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix rcu_tasks stall in threaded busypoll\n\nI was debugging a NIC driver when I noticed that when I enable\nthreaded busypoll, bpftrace hangs when starting up. dmesg showed:\n\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 10658 jiffies old.\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 40793 jiffies old.\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 131273 jiffies old.\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 402058 jiffies old.\n  INFO: rcu_tasks detected stalls on tasks:\n  00000000769f52cd: .N nvcsw: 2/2 holdout: 1 idle_cpu: -1/64\n  task:napi/eth2-8265  state:R  running task     stack:0     pid:48300 tgid:48300 ppid:2      task_flags:0x208040 flags:0x00004000\n  Call Trace:\n   \u003cTASK\u003e\n   ? napi_threaded_poll_loop+0x27c/0x2c0\n   ? __pfx_napi_threaded_poll+0x10/0x10\n   ? napi_threaded_poll+0x26/0x80\n   ? kthread+0xfa/0x240\n   ? __pfx_kthread+0x10/0x10\n   ? ret_from_fork+0x31/0x50\n   ? __pfx_kthread+0x10/0x10\n   ? ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n\nThe cause is that in threaded busypoll, the main loop is in\nnapi_threaded_poll rather than napi_threaded_poll_loop, where the\nlatter rarely iterates more than once within its loop. For\nrcu_softirq_qs_periodic inside napi_threaded_poll_loop to report its\nqs state, the last_qs must be 100ms behind, and this can\u0027t happen\nbecause napi_threaded_poll_loop rarely iterates in threaded busypoll,\nand each time napi_threaded_poll_loop is called last_qs is reset to\nlatest jiffies.\n\nThis patch changes so that in threaded busypoll, last_qs is saved\nin the outer napi_threaded_poll, and whether busy_poll_last_qs\nis NULL indicates whether napi_threaded_poll_loop is called for\nbusypoll. This way last_qs would not reset to latest jiffies on\neach invocation of napi_threaded_poll_loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In a reasonable high-impact deployment, threaded NAPI busy-poll is enabled on a network-facing NIC/forwarder, and received packets schedule the NAPI kthread into the vulnerable polling loop. The netlink knob is an administrative deployment gate, but a remote sender needs no local access once that mode is in use.\nAC:L - There is no attacker-controlled race or fragile timing requirement; once the NAPI thread is in threaded busy-poll mode, repeated loop invocations reliably fail to report RCU Tasks quiescent states. Packet delivery to the configured NAPI is sufficient to activate the path.\nPR:N - The highest-impact scenario is an already-configured network service/device where the attacker only sends packets and needs no account or credentials. Enabling threaded busy-poll itself requires init-namespace CAP_NET_ADMIN, but that is a deployment precondition rather than an exploit privilege in this scenario.\nUI:N - No victim user action is required after the affected NAPI mode is configured. Network traffic alone can keep the vulnerable kthread path active.\nS:U - The impact remains within the kernel and host networking/RCU scheduling authority. There is no VM escape, sandbox boundary crossing, or separate security authority affected.\nC:N - The bug is an RCU Tasks quiescent-state starvation/stall, not memory corruption or an information disclosure path. I found no read primitive or exposure of protected data.\nI:N - The flaw does not provide an arbitrary write, control-flow hijack, or data modification primitive. It only prevents timely RCU Tasks grace-period progress.\nA:H - The vulnerable loop can indefinitely stall RCU Tasks grace periods, causing kernel operations such as tracing/BPF setup or teardown to hang and producing persistent RCU stall reports. This is a kernel-level hang/deadlock-style availability failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:43.989Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/52459201d0df3fdbb1d281738b7b772e2cacb49c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a86a1f7d88996085934139fa4c063b6299a2dd3"
        }
      ],
      "title": "net: Fix rcu_tasks stall in threaded busypoll",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43385",
    "datePublished": "2026-05-08T14:21:32.007Z",
    "dateReserved": "2026-05-01T14:12:56.006Z",
    "dateUpdated": "2026-08-05T12:27:43.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43385",
      "date": "2026-09-15",
      "epss": "0.00344",
      "percentile": "0.27632"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43385\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:49.830\",\"lastModified\":\"2026-06-17T10:49:29.980\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: Fix rcu_tasks stall in threaded busypoll\\n\\nI was debugging a NIC driver when I noticed that when I enable\\nthreaded busypoll, bpftrace hangs when starting up. dmesg showed:\\n\\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 10658 jiffies old.\\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 40793 jiffies old.\\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 131273 jiffies old.\\n  rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 402058 jiffies old.\\n  INFO: rcu_tasks detected stalls on tasks:\\n  00000000769f52cd: .N nvcsw: 2/2 holdout: 1 idle_cpu: -1/64\\n  task:napi/eth2-8265  state:R  running task     stack:0     pid:48300 tgid:48300 ppid:2      task_flags:0x208040 flags:0x00004000\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? napi_threaded_poll_loop+0x27c/0x2c0\\n   ? __pfx_napi_threaded_poll+0x10/0x10\\n   ? napi_threaded_poll+0x26/0x80\\n   ? kthread+0xfa/0x240\\n   ? __pfx_kthread+0x10/0x10\\n   ? ret_from_fork+0x31/0x50\\n   ? __pfx_kthread+0x10/0x10\\n   ? ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n\\nThe cause is that in threaded busypoll, the main loop is in\\nnapi_threaded_poll rather than napi_threaded_poll_loop, where the\\nlatter rarely iterates more than once within its loop. For\\nrcu_softirq_qs_periodic inside napi_threaded_poll_loop to report its\\nqs state, the last_qs must be 100ms behind, and this can\u0027t happen\\nbecause napi_threaded_poll_loop rarely iterates in threaded busypoll,\\nand each time napi_threaded_poll_loop is called last_qs is reset to\\nlatest jiffies.\\n\\nThis patch changes so that in threaded busypoll, last_qs is saved\\nin the outer napi_threaded_poll, and whether busy_poll_last_qs\\nis NULL indicates whether napi_threaded_poll_loop is called for\\nbusypoll. This way last_qs would not reset to latest jiffies on\\neach invocation of napi_threaded_poll_loop.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c18d4b190a46651726c9a952667c74d2deb33c28\",\"lessThan\":\"52459201d0df3fdbb1d281738b7b772e2cacb49c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c18d4b190a46651726c9a952667c74d2deb33c28\",\"lessThan\":\"1a86a1f7d88996085934139fa4c063b6299a2dd3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a86a1f7d88996085934139fa4c063b6299a2dd3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52459201d0df3fdbb1d281738b7b772e2cacb49c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-02T12:51:32+00:00",
      "cve": "CVE-2026-43385",
      "id": "CVE-2026-43385",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: Fix rcu_tasks stall in threaded busypoll",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43385.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:20:08Z",
      "cve": "CVE-2026-43385",
      "id": "CVE-2026-43385",
      "initial_release_date": "2026-05-12T03:30:24Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43385",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43385.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.