Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-43167— xfrm: always flush state and policy upon NETDEV_UNREGISTER event

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在NETDEV_UNREGISTER事件时未刷新状态和策略，可能导致引用计数泄漏。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux d77e38e612a017480157fe6d2c1422f42cb5b7e3< 166801e49a5b5fc127b8c9e2f110f303cfddfbc3 affected
d77e38e612a017480157fe6d2c1422f42cb5b7e3< a3c8fede034fa27892f87c863cbd5493167d17ed affected
d77e38e612a017480157fe6d2c1422f42cb5b7e3< 59581778792cbaf8ad788f4a21dc663ce986050e affected
d77e38e612a017480157fe6d2c1422f42cb5b7e3< 8c75c455ecd3bfd2f36abf66edb7021c4fa19ec4 affected
d77e38e612a017480157fe6d2c1422f42cb5b7e3< 4efa91a28576054aae0e6dad9cba8fed8293aef8 affected
4.12 affected
< 4.12 unaffected
6.6.128≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-43167

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xfrm: always flush state and policy upon NETDEV_UNREGISTER event
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: always flush state and policy upon NETDEV_UNREGISTER event syzbot is reporting that "struct xfrm_state" refcount is leaking. unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2 ref_tracker: netdev@ffff888052f24618 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_tracker_alloc include/linux/netdevice.h:4412 [inline] xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316 xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline] xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022 xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550 xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2646 __sys_sendmsg+0x16d/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") implemented xfrm_dev_unregister() as no-op despite xfrm_dev_state_add() from xfrm_state_construct() acquires a reference to "struct net_device". I guess that that commit expected that NETDEV_DOWN event is fired before NETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add() is called only if (dev->features & NETIF_F_HW_ESP) != 0. Sabrina Dubroca identified steps to reproduce the same symptoms as below. echo 0 > /sys/bus/netdevsim/new_device dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/) ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \ spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \ offload crypto dev $dev dir out ethtool -K $dev esp-hw-offload off echo 0 > /sys/bus/netdevsim/del_device Like these steps indicate, the NETIF_F_HW_ESP bit can be cleared after xfrm_dev_state_add() acquired a reference to "struct net_device". Also, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit when acquiring a reference to "struct net_device". Commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device") re-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that commit for unknown reason chose to share xfrm_dev_down() between the NETDEV_DOWN event and the NETDEV_UNREGISTER event. I guess that that commit missed the behavior in the previous paragraph. Therefore, we need to re-introduce xfrm_dev_unregister() in order to release the reference to "struct net_device" by unconditionally flushing state and policy.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在NETDEV_UNREGISTER事件时未刷新状态和策略，可能导致引用计数泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d77e38e612a017480157fe6d2c1422f42cb5b7e3 ~ 166801e49a5b5fc127b8c9e2f110f303cfddfbc3 -
Linux Linux 4.12 -

II. Public POCs for CVE-2026-43167

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43167

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-43167 (5)

Same Patch Batch · Linux · 2026-05-06 · 224 CVEs total

CVE-2026-43208 9.8 CRITICAL net: do not pass flow_id to set_rps_cpu()
CVE-2026-43125 9.8 CRITICAL dlm: validate length in dlm_search_rsb_tree
CVE-2026-43198 9.8 CRITICAL tcp: fix potential race in tcp_v6_syn_recv_sock()
CVE-2026-43186 9.8 CRITICAL ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
CVE-2026-43185 9.8 CRITICAL ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
CVE-2026-43114 9.4 CRITICAL netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
CVE-2026-43197 9.1 CRITICAL netconsole: avoid OOB reads, msg is not nul-terminated
CVE-2026-43117 9.1 CRITICAL btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
CVE-2026-43083 9.1 CRITICAL net: ioam6: fix OOB and missing lock
CVE-2026-43239 8.8 HIGH smb: client: prevent races in ->query_interfaces()
CVE-2026-43113 8.8 HIGH wifi: wl1251: validate packet IDs before indexing tx_frames
CVE-2026-43158 8.8 HIGH xfs: fix freemap adjustments when adding xattrs to leaf blocks
CVE-2026-43232 8.8 HIGH net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
CVE-2026-43172 8.8 HIGH wifi: iwlwifi: fix 22000 series SMEM parsing
CVE-2026-43283 8.8 HIGH net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
CVE-2026-43176 8.8 HIGH wifi: rtw89: pci: validate release report content before using for RTL8922DE
CVE-2026-43112 8.8 HIGH fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
CVE-2026-43215 8.8 HIGH cifs: Fix locking usage for tcon fields
CVE-2026-43249 8.8 HIGH 9p/xen: protect xen_9pfs_front_free against concurrent calls
CVE-2026-43110 8.8 HIGH wifi: brcmfmac: validate bsscfg indices in IF events

Showing top 20 of 224 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43167

No comments yet

Leave a comment