CVE-2026-43374

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: nexthop: fix percpu use-after-free in remove_nh_grp_entry<br /> <br /> When removing a nexthop from a group, remove_nh_grp_entry() publishes<br /> the new group via rcu_assign_pointer() then immediately frees the<br /> removed entry&amp;#39;s percpu stats with free_percpu(). However, the<br /> synchronize_net() grace period in the caller remove_nexthop_from_groups()<br /> runs after the free. RCU readers that entered before the publish still<br /> see the old group and can dereference the freed stats via<br /> nh_grp_entry_stats_inc() -&gt; get_cpu_ptr(nhge-&gt;stats), causing a<br /> use-after-free on percpu memory.<br /> <br /> Fix by deferring the free_percpu() until after synchronize_net() in the<br /> caller. Removed entries are chained via nh_list onto a local deferred<br /> free list. After the grace period completes and all RCU readers have<br /> finished, the percpu stats are safely freed.