GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43402 (GCVE-0-2026-43402)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-08-05 12:27
VLAI
Title
kthread: consolidate kthread exit paths to prevent use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread exit paths to prevent use-after-free Guillaume reported crashes via corrupted RCU callback function pointers during KUnit testing. The crash was traced back to the pidfs rhashtable conversion which replaced the 24-byte rb_node with an 8-byte rhash_head in struct pid, shrinking it from 160 to 144 bytes. struct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to 192 bytes and share the same slab cache. struct pid.rcu.func and struct kthread.affinity_node both sit at offset 0x78. When a kthread exits via make_task_dead() it bypasses kthread_exit() and misses the affinity_node cleanup. free_kthread_struct() frees the memory while the node is still linked into the global kthread_affinity_list. A subsequent list_del() by another kthread writes through dangling list pointers into the freed and reused memory, corrupting the pid's rcu.func pointer. Instead of patching free_kthread_struct() to handle the missed cleanup, consolidate all kthread exit paths. Turn kthread_exit() into a macro that calls do_exit() and add kthread_do_exit() which is called from do_exit() for any task with PF_KTHREAD set. This guarantees that kthread-specific cleanup always happens regardless of the exit path - make_task_dead(), direct do_exit(), or kthread_exit(). Replace __to_kthread() with a new tsk_is_kthread() accessor in the public header. Export do_exit() since module code using the kthread_exit() macro now needs it directly.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4d13f4304fa43471bfea101658a11feec7b28ac0 , < 4729c7b00a347fd37d0cbc265b85f2884c3e06b6 (git)
Affected: 4d13f4304fa43471bfea101658a11feec7b28ac0 , < 5a591d7a5e48d30100943940a30a6ab41b15c672 (git)
Affected: 4d13f4304fa43471bfea101658a11feec7b28ac0 , < 28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/kthread.h",
            "kernel/exit.c",
            "kernel/kthread.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4729c7b00a347fd37d0cbc265b85f2884c3e06b6",
              "status": "affected",
              "version": "4d13f4304fa43471bfea101658a11feec7b28ac0",
              "versionType": "git"
            },
            {
              "lessThan": "5a591d7a5e48d30100943940a30a6ab41b15c672",
              "status": "affected",
              "version": "4d13f4304fa43471bfea101658a11feec7b28ac0",
              "versionType": "git"
            },
            {
              "lessThan": "28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f",
              "status": "affected",
              "version": "4d13f4304fa43471bfea101658a11feec7b28ac0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/kthread.h",
            "kernel/exit.c",
            "kernel/kthread.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkthread: consolidate kthread exit paths to prevent use-after-free\n\nGuillaume reported crashes via corrupted RCU callback function pointers\nduring KUnit testing. The crash was traced back to the pidfs rhashtable\nconversion which replaced the 24-byte rb_node with an 8-byte rhash_head\nin struct pid, shrinking it from 160 to 144 bytes.\n\nstruct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With\nCONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to\n192 bytes and share the same slab cache. struct pid.rcu.func and\nstruct kthread.affinity_node both sit at offset 0x78.\n\nWhen a kthread exits via make_task_dead() it bypasses kthread_exit() and\nmisses the affinity_node cleanup. free_kthread_struct() frees the memory\nwhile the node is still linked into the global kthread_affinity_list. A\nsubsequent list_del() by another kthread writes through dangling list\npointers into the freed and reused memory, corrupting the pid\u0027s\nrcu.func pointer.\n\nInstead of patching free_kthread_struct() to handle the missed cleanup,\nconsolidate all kthread exit paths. Turn kthread_exit() into a macro\nthat calls do_exit() and add kthread_do_exit() which is called from\ndo_exit() for any task with PF_KTHREAD set. This guarantees that\nkthread-specific cleanup always happens regardless of the exit path -\nmake_task_dead(), direct do_exit(), or kthread_exit().\n\nReplace __to_kthread() with a new tsk_is_kthread() accessor in the\npublic header. Export do_exit() since module code using the\nkthread_exit() macro now needs it directly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In the most severe reasonable deployment, network-facing in-kernel services such as ksmbd create kthreads and process unauthenticated remote traffic in those kthreads. The vulnerable kthread lifecycle and exit cleanup can therefore be reached from a remote network path.\nAC:L - The bug is a deterministic cleanup omission once an affected kthread exits through a bypass path such as make_task_dead/do_exit, and the resulting dangling list entry can be exercised by normal kthread churn. There is no attacker-uncontrolled race required for the UAF mechanism itself.\nPR:N - For network-facing kthread users such as ksmbd connection handlers, an unauthenticated remote peer can drive pre-authentication packet handling and connection-thread creation. No local account or kernel capability is required in that scenario.\nUI:N - Exploitation does not require a victim user to open a file, mount a filesystem, or perform another interactive action. The attacker can send traffic or otherwise drive the reachable service path directly.\nS:U - The corruption occurs within the Linux kernel and impacts kernel-managed memory and control flow. It does not inherently cross a separate security authority such as a VM-to-host or IOMMU boundary.\nC:H - This is a use-after-free of a freed struct kthread left linked into a global list, with later list operations writing into reused slab memory such as struct pid. Kernel UAF memory corruption is treated as capable of yielding high confidentiality impact through read/info-disclosure primitives.\nI:H - The stale list entry causes writes through dangling list pointers into a reused object, including corruption of sensitive fields such as an RCU callback pointer. Such kernel UAF corruption is defensibly exploitable for arbitrary write or control-flow hijack.\nA:H - The observed failure mode is corrupted RCU callback function pointers and kernel crashes. Even without full exploitation, repeated triggering can oops or panic the kernel, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:46.142Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4729c7b00a347fd37d0cbc265b85f2884c3e06b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a591d7a5e48d30100943940a30a6ab41b15c672"
        },
        {
          "url": "https://git.kernel.org/stable/c/28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f"
        }
      ],
      "title": "kthread: consolidate kthread exit paths to prevent use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43402",
    "datePublished": "2026-05-08T14:21:43.550Z",
    "dateReserved": "2026-05-01T14:12:56.007Z",
    "dateUpdated": "2026-08-05T12:27:46.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43402",
      "date": "2026-09-16",
      "epss": "0.00456",
      "percentile": "0.38679"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43402\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:51.670\",\"lastModified\":\"2026-06-17T10:49:31.723\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkthread: consolidate kthread exit paths to prevent use-after-free\\n\\nGuillaume reported crashes via corrupted RCU callback function pointers\\nduring KUnit testing. The crash was traced back to the pidfs rhashtable\\nconversion which replaced the 24-byte rb_node with an 8-byte rhash_head\\nin struct pid, shrinking it from 160 to 144 bytes.\\n\\nstruct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With\\nCONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to\\n192 bytes and share the same slab cache. struct pid.rcu.func and\\nstruct kthread.affinity_node both sit at offset 0x78.\\n\\nWhen a kthread exits via make_task_dead() it bypasses kthread_exit() and\\nmisses the affinity_node cleanup. free_kthread_struct() frees the memory\\nwhile the node is still linked into the global kthread_affinity_list. A\\nsubsequent list_del() by another kthread writes through dangling list\\npointers into the freed and reused memory, corrupting the pid\u0027s\\nrcu.func pointer.\\n\\nInstead of patching free_kthread_struct() to handle the missed cleanup,\\nconsolidate all kthread exit paths. Turn kthread_exit() into a macro\\nthat calls do_exit() and add kthread_do_exit() which is called from\\ndo_exit() for any task with PF_KTHREAD set. This guarantees that\\nkthread-specific cleanup always happens regardless of the exit path -\\nmake_task_dead(), direct do_exit(), or kthread_exit().\\n\\nReplace __to_kthread() with a new tsk_is_kthread() accessor in the\\npublic header. Export do_exit() since module code using the\\nkthread_exit() macro now needs it directly.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/kthread.h\",\"kernel/exit.c\",\"kernel/kthread.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4d13f4304fa43471bfea101658a11feec7b28ac0\",\"lessThan\":\"4729c7b00a347fd37d0cbc265b85f2884c3e06b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d13f4304fa43471bfea101658a11feec7b28ac0\",\"lessThan\":\"5a591d7a5e48d30100943940a30a6ab41b15c672\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d13f4304fa43471bfea101658a11feec7b28ac0\",\"lessThan\":\"28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/kthread.h\",\"kernel/exit.c\",\"kernel/kthread.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"7484E98E-61F0-4DCE-9DBF-83D2F75F99EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4729c7b00a347fd37d0cbc265b85f2884c3e06b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a591d7a5e48d30100943940a30a6ab41b15c672\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T12:46:45+00:00",
      "cve": "CVE-2026-43402",
      "id": "CVE-2026-43402",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kthread: consolidate kthread exit paths to prevent use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43402.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:20:06Z",
      "cve": "CVE-2026-43402",
      "id": "CVE-2026-43402",
      "initial_release_date": "2026-05-12T03:30:16Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43402",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43402.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.