LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43385: net: Fix rcu_tasks stall in threaded busypoll

In the Linux kernel, the following vulnerability has been resolved: net: Fix rcu_tasks stall in threaded busypoll I was debugging a NIC driver when I noticed that when I enable threaded busypoll, bpftrace hangs when starting up. dmesg showed: rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 10658 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 40793 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 131273 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 402058 jiffies old. INFO: rcu_tasks detected stalls on tasks: 00000000769f52cd: .N nvcsw: 2/2 holdout: 1 idle_cpu: -1/64 task:napi/eth2-8265 state:R running task stack:0 pid:48300 tgid:48300 ppid:2 task_flags:0x208040 flags:0x00004000 Call Trace: <TASK> ? napi_threaded_poll_loop+0x27c/0x2c0 ? __pfx_napi_threaded_poll+0x10/0x10 ? napi_threaded_poll+0x26/0x80 ? kthread+0xfa/0x240 ? __pfx_kthread+0x10/0x10 ? ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ? ret_from_fork_asm+0x1a/0x30 </TASK> The cause is that in threaded busypoll, the main loop is in napi_threaded_poll rather than napi_threaded_poll_loop, where the latter rarely iterates more than once within its loop. For rcu_softirq_qs_periodic inside napi_threaded_poll_loop to report its qs state, the last_qs must be 100ms behind, and this can't happen because napi_threaded_poll_loop rarely iterates in threaded busypoll, and each time napi_threaded_poll_loop is called last_qs is reset to latest jiffies. This patch changes so that in threaded busypoll, last_qs is saved in the outer napi_threaded_poll, and whether busy_poll_last_qs is NULL indicates whether napi_threaded_poll_loop is called for busypoll. This way last_qs would not reset to latest jiffies on each invocation of napi_threaded_poll_loop.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux networking flaw can cause kernel RCU task stalls when threaded busy-polling is enabled. Affected systems may experience hung observability tools or broader availability degradation. The supplied CVSS score is 7.5 because availability can be seriously affected; no confidentiality or integrity impact is identified.

Executive priority

Treat this as an expedited availability update for exposed network infrastructure, especially systems using threaded busy-polling. Schedule vendor-approved kernel updates and reboots promptly after compatibility testing. Prioritize by feature usage and operational criticality rather than assuming every Linux host is equally exposed.

Technical view

In threaded busy-poll mode, the NAPI polling loop repeatedly reset its quiescent-state timestamp before the required interval elapsed. Consequently, the task could fail to report an RCU quiescent state and stall grace-period processing. The referenced kernel changes preserve the timestamp in the outer polling loop.

Likely exposure

Exposure is most likely on affected Linux 6.19-series systems using threaded busy-poll networking, particularly latency-tuned or high-throughput hosts. The bundle identifies versions through 6.19.9 as affected but does not provide complete distribution package mappings. Systems without this feature enabled appear less likely to encounter the described condition.

Exploitation context

The CVSS vector labels the issue remotely reachable, without privileges or user interaction. However, the supplied evidence documents a failure observed during NIC debugging, not a demonstrated remote exploit. CISA KEV status is false, and no cited source establishes active exploitation, public weaponization, or a proven network-triggering method.

Researcher notes

The documented symptom is an RCU Tasks grace-period stall involving a NAPI kernel thread; bpftrace hanging was the observed indicator. The fix changes quiescent-state timestamp lifetime across threaded busy-poll iterations. The bundle supplies two stable-tree commits but does not map them to distributions or establish exploitability beyond the reported availability failure.

Mitigation direction

  • Install a vendor kernel package containing the applicable referenced stable-kernel fix.
  • Check distribution guidance for exact fixed package versions and required reboot procedures.
  • Prioritize latency-tuned systems known to use threaded busy-poll networking.
  • If patching is delayed, ask the vendor whether disabling threaded busy-polling is supported.

Validation and detection

  • Inventory running kernels and identify systems within the reported affected version range.
  • Determine whether threaded busy-poll networking is enabled on each potentially affected host.
  • Verify the installed kernel includes the applicable referenced fix commit.
  • Review kernel logs for RCU task stalls involving NAPI threads.
  • After updating, confirm the fixed kernel is running and repeat workload testing.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43385 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-43385Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc18d4b190a46651726c9a952667c74d2deb33c28, c18d4b190a46651726c9a952667c74d2deb33c28unaffected
LinuxLinux6.19, 0, 6.19.9, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.