Security readout for executives and security teams
Plain-English summary
A Linux kernel race can free IPsec policy hash tables while another kernel task is still reading them during network-namespace shutdown. A local, low-privileged user may be able to trigger memory corruption, potentially affecting confidentiality, integrity, and availability. The supplied CVSS score is 7.8.
Executive priority
Schedule expedited remediation, especially for shared Linux infrastructure and hosts accessible by untrusted local users. Internet-only exposure is not supported by the supplied evidence, so prioritize by local-access and container-isolation risk. Confirm exact vendor package status because the supplied version list is incomplete or ambiguous.
Technical view
xfrm_policy_fini() flushes work and deletes policies but frees policy_bydst tables without first waiting for existing RCU readers. Because those tables are RCU-published and dereferenced, teardown can race with readers. The upstream resolution adds synchronize_rcu() before freeing the tables. The bundle does not establish reliable exploitation or specific attack outcomes.
Likely exposure
Exposure is most relevant to Linux systems where low-privileged local users can cause network-namespace and XFRM policy lifecycle activity, including some containerized or multi-tenant hosts. The supplied affected-version data is ambiguous and should not be treated as complete range notation. Confirm exposure through distribution or kernel-vendor advisories and backport records.
Exploitation context
The CVSS vector indicates local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. However, the bundle provides no public exploit evidence, and the CVE is not listed as KEV. Treat exploitation status as unconfirmed rather than active.
Researcher notes
The core condition is an RCU lifetime violation during XFRM policy network-namespace teardown. Five stable-kernel commits are referenced, apparently representing maintained branches, but the bundle does not map each commit to a release. No CWE is assigned. Avoid inferring deterministic privilege escalation: the stated impacts derive from CVSS, while practical exploitability remains unsubstantiated.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the synchronize_rcu() fix or an equivalent backport.
- Check distribution and appliance advisories for CVE-2026-43091 and their exact affected package versions.
- Prioritize multi-tenant, container-hosting, and other systems granting local access to untrusted users.
- Restrict unnecessary local access and network-namespace capabilities until patched, where operationally feasible.
Validation and detection
- Record running kernel and installed package versions across potentially exposed Linux systems.
- Confirm vendor changelogs cite CVE-2026-43091 or one of the referenced stable-kernel commits.
- Verify the deployed kernel includes an RCU grace period before policy_bydst tables are freed.
- Reboot after kernel replacement, then confirm systems are running the remediated kernel.
- Monitor kernel logs for unexplained XFRM, RCU, memory-corruption, or namespace-teardown failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43091 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937CVE reference, Linux
- https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9eCVE reference, Linux
- https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094CVE reference, Linux
- https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028CVE reference, Linux
- https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.