Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-43402: Linux kernel kthread exit can cause memory corruption
CVE-2026-43402 · published 6 months ago
Summary
The Linux kernel versions used in Ubuntu and related distributions have a flaw where a background thread may free memory while still being referenced, leading to possible crashes or data corruption. This occurs when certain threads stop, and the cleanup code does not run correctly. Updating the kernel to the latest packages from your distribution will apply the fix and prevent the issue.
What to do
- Update debian linux to version 6.19.10-1.
- Update canonical linux-aws-6.17 to version 6.17.0-1019.19~24.04.1.
- Update canonical linux-azure-6.17 to version 6.17.0-1021.21~24.04.1.
- Update canonical linux-gcp-6.17 to version 6.17.0-1020.22~24.04.1.
- Update canonical linux-hwe-6.17 to version 6.17.0-40.40~24.04.1.
- Update canonical linux-nvidia-6.17 to version 6.17.0-1026.26.
- Update canonical linux-oem-6.17 to version 6.17.0-1028.28.
- Update canonical linux-oracle-6.17 to version 6.17.0-1018.18~24.04.1.
- Update canonical linux-realtime-6.17 to version 6.17.0-1017.19~24.04.1.
- Update canonical linux to version 6.17.0-40.40.
- Update canonical linux-aws to version 6.17.0-1019.19.
- Update canonical linux-gcp to version 6.17.0-1020.22.
- Update canonical linux-oracle to version 6.17.0-1018.18.
- Update canonical linux-raspi to version 6.17.0-1021.21.
- Update canonical linux-realtime to version 6.17.0-1017.19.
- Update canonical linux-riscv to version 6.17.0-40.40.1.
- Update linux kernel to version 6.19.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
7.0 >= 6.14, < 6.18.19 >= 6.19, < 6.19.9 cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
Showing 50 of 123. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.17 |
< 6.17.0-1019.19~24.04.1 Fix: upgrade to 6.17.0-1019.19~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.17 |
< 6.17.0-1021.21~24.04.1 Fix: upgrade to 6.17.0-1021.21~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.17 |
< 6.17.0-1020.22~24.04.1 Fix: upgrade to 6.17.0-1020.22~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.17 |
< 6.17.0-40.40~24.04.1 Fix: upgrade to 6.17.0-40.40~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.17 |
< 6.17.0-1028.28 Fix: upgrade to 6.17.0-1028.28
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.17 |
< 6.17.0-1018.18~24.04.1 Fix: upgrade to 6.17.0-1018.18~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.17 | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.14 | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.17 |
< 6.17.0-1017.19~24.04.1 Fix: upgrade to 6.17.0-1017.19~24.04.1
|
| Ubuntu:25.10 | canonical | linux |
< 6.17.0-40.40 Fix: upgrade to 6.17.0-40.40
|
| Ubuntu:25.10 | canonical | linux-aws |
< 6.17.0-1019.19 Fix: upgrade to 6.17.0-1019.19
|
| Ubuntu:25.10 | canonical | linux-azure | All versions |
| Ubuntu:25.10 | canonical | linux-azure-fde | All versions |
| Ubuntu:25.10 | canonical | linux-gcp |
< 6.17.0-1020.22 Fix: upgrade to 6.17.0-1020.22
|
| Ubuntu:25.10 | canonical | linux-oracle |
< 6.17.0-1018.18 Fix: upgrade to 6.17.0-1018.18
|
| Ubuntu:25.10 | canonical | linux-raspi |
< 6.17.0-1021.21 Fix: upgrade to 6.17.0-1021.21
|
| Ubuntu:25.10 | canonical | linux-realtime |
< 6.17.0-1017.19 Fix: upgrade to 6.17.0-1017.19
|
| Ubuntu:25.10 | canonical | linux-riscv |
< 6.17.0-40.40.1 Fix: upgrade to 6.17.0-40.40.1
|
| Ubuntu:26.04:LTS | canonical | linux-azure-fde | All versions |
| Debian:14 | debian | linux |
< 6.19.10-1 Fix: upgrade to 6.19.10-1
|
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.17 |
< 6.17.0-1026.26 Fix: upgrade to 6.17.0-1026.26
|
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Linux | linux | kernel |
>= 6.19.0, < 6.19.9 Fix: upgrade to 6.19.9
|
Original advisory text
kthread: consolidate kthread exit paths to prevent use-after-free
In the Linux kernel, the following vulnerability has been resolved:
kthread: consolidate kthread exit paths to prevent use-after-free
Guillaume reported crashes via corrupted RCU callback function pointers
during KUnit testing. The crash was traced back to the pidfs rhashtable
conversion which replaced the 24-byte rb_node with an 8-byte rhash_head
in struct pid, shrinking it from 160 to 144 bytes.
struct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With
CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to
192 bytes and share the same slab cache. struct pid.rcu.func and
struct kthread.affinity_node both sit at offset 0x78.
When a kthread exits via make_task_dead() it bypasses kthread_exit() and
misses the affinity_node cleanup. free_kthread_struct() frees the memory
while the node is still linked into the global kthread_affinity_list. A
subsequent list_del() by another kthread writes through dangling list
pointers into the freed and reused memory, corrupting the pid's
rcu.func pointer.
Instead of patching free_kthread_struct() to handle the missed cleanup,
consolidate all kthread exit paths. Turn kthread_exit() into a macro
that calls do_exit() and add kthread_do_exit() which is called from
do_exit() for any task with PF_KTHREAD set. This guarantees that
kthread-specific cleanup always happens regardless of the exit path -
make_task_dead(), direct do_exit(), or kthread_exit().
Replace __to_kthread() with a new tsk_is_kthread() accessor in the
public header. Export do_exit() since module code using the
kthread_exit() macro now needs it directly.
kthread: consolidate kthread exit paths to prevent use-after-free
Guillaume reported crashes via corrupted RCU callback function pointers
during KUnit testing. The crash was traced back to the pidfs rhashtable
conversion which replaced the 24-byte rb_node with an 8-byte rhash_head
in struct pid, shrinking it from 160 to 144 bytes.
struct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With
CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to
192 bytes and share the same slab cache. struct pid.rcu.func and
struct kthread.affinity_node both sit at offset 0x78.
When a kthread exits via make_task_dead() it bypasses kthread_exit() and
misses the affinity_node cleanup. free_kthread_struct() frees the memory
while the node is still linked into the global kthread_affinity_list. A
subsequent list_del() by another kthread writes through dangling list
pointers into the freed and reused memory, corrupting the pid's
rcu.func pointer.
Instead of patching free_kthread_struct() to handle the missed cleanup,
consolidate all kthread exit paths. Turn kthread_exit() into a macro
that calls do_exit() and add kthread_do_exit() which is called from
do_exit() for any task with PF_KTHREAD set. This guarantees that
kthread-specific cleanup always happens regardless of the exit path -
make_task_dead(), direct do_exit(), or kthread_exit().
Replace __to_kthread() with a new tsk_is_kthread() accessor in the
public header. Export do_exit() since module code using the
kthread_exit() macro now needs it directly.
References
- https://security-tracker.debian.org/tracker/CVE-2026-43402 Vendor Advisory
- https://git.kernel.org/stable/c/28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f URL
- https://git.kernel.org/stable/c/4729c7b00a347fd37d0cbc265b85f2884c3e06b6 URL
- https://www.cve.org/CVERecord?id=CVE-2026-43402 Third Party Advisory
- https://git.kernel.org/linus/28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f Third Party Advisory
- https://ubuntu.com/security/CVE-2026-43402 Third Party Advisory
- https://git.kernel.org/stable/c/5a591d7a5e48d30100943940a30a6ab41b15c672 URL
- https://ubuntu.com/security/notices/USN-8490-1 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43402... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-43402 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://ubuntu.com/security/notices/USN-8491-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8508-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8490-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8545-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8546-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8604-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8605-1 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published8 May 2026
Updated4 Nov 2026
First seen8 May 2026
Sources
DEBIAN-CVE-2026-43402 · OSV
CVE-2026-43402 · NVD
UBUNTU-CVE-2026-43402 · OSV
CVE-2026-43402 · OSV
Track software like this
Free during beta