---
id: CVE-2026-43374
title: 'net: nexthop: fix percpu use-after-free in remove_nh_grp_entry'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: nexthop: fix percpu use-after-free in remove_nh_grp_entry

  When removing a nexthop from a group, remove_nh_grp_entry() publishes
  the new group via rcu_assign_point…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f <
    abf4feaee6405f1441929c6ebe7a250f2cd170a7
  - >-
    Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f <
    ab5ebab9664214ba41a7633cb4e72f128204f924
  - >-
    Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f <
    9e08ad731862b22a87cc55f752e16d66cdc9e231
  - >-
    Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f <
    b2662e7593e94ae09b1cf7ee5f09160a3612bcb2
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:16:55.959084Z'
published: '2026-05-08'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:40.518Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43374'
references:
  - url: 'https://git.kernel.org/stable/c/abf4feaee6405f1441929c6ebe7a250f2cd170a7'
  - url: 'https://git.kernel.org/stable/c/ab5ebab9664214ba41a7633cb4e72f128204f924'
  - url: 'https://git.kernel.org/stable/c/9e08ad731862b22a87cc55f752e16d66cdc9e231'
  - url: 'https://git.kernel.org/stable/c/b2662e7593e94ae09b1cf7ee5f09160a3612bcb2'
tags:
  - cve.org
epss: 0.0017
epssPercentile: 0.05954
ingestedAt: '2026-10-16T17:24:46.694Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: nexthop: fix percpu use-after-free in remove_nh_grp_entry

When removing a nexthop from a group, remove_nh_grp_entry() publishes
the new group via rcu_assign_pointer() then immediately frees the
removed entry's percpu stats with free_percpu(). However, the
synchronize_net() grace period in the caller remove_nexthop_from_groups()
runs after the free. RCU readers that entered before the publish still
see the old group and can dereference the freed stats via
nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), causing a
use-after-free on percpu memory.

Fix by deferring the free_percpu() until after synchronize_net() in the
caller. Removed entries are chained via nh_list onto a local deferred
free list. After the grace period completes and all RCU readers have
finished, the percpu stats are safely freed.

## Affected

- `Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f < abf4feaee6405f1441929c6ebe7a250f2cd170a7`
- `Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f < ab5ebab9664214ba41a7633cb4e72f128204f924`
- `Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f < 9e08ad731862b22a87cc55f752e16d66cdc9e231`
- `Linux >= f4676ea74b8549cd88dbfe2a592ce4530039e61f < b2662e7593e94ae09b1cf7ee5f09160a3612bcb2`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.