CVE-2026-43167
Memory Leak in Linux Kernel XFRM Subsystem
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's xfrm subsystem, where a reference count leak occurs due to improper handling of network device unregister events.
Specifically, the function xfrm_dev_unregister() was implemented as a no-op, which means it did not release references to network devices as expected. This leads to a situation where the reference count on a network device structure (struct net_device) is not properly decremented, causing the device to remain in use and not be freed.
The problem arises because the code assumed that the NETDEV_DOWN event would always be fired before NETDEV_UNREGISTER and that certain hardware offloading features would be set, but these assumptions do not always hold true. As a result, references acquired by xfrm_dev_state_add() are not released during device unregister, causing a leak.
How can this vulnerability impact me? :
This vulnerability can cause resource leaks in the Linux kernel by preventing network device structures from being properly freed when they are unregistered.
Over time, this can lead to increased memory usage and potentially degrade system performance or stability, especially on systems that frequently add and remove network devices or use IPsec hardware offloading features.
In environments relying on secure networking features like IPsec, this could also impact the reliability of network security operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing if the reference count for "struct xfrm_state" is leaking, which may cause the system to wait indefinitely for network devices to become free.
One way to reproduce or detect the issue involves using the netdevsim device and ip xfrm commands as follows:
- echo 0 > /sys/bus/netdevsim/new_device
- dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/)
- ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 offload crypto dev $dev dir out
- ethtool -K $dev esp-hw-offload off
- echo 0 > /sys/bus/netdevsim/del_device
If the system logs show messages like "unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2" or refcount leaks related to xfrm_state, it indicates the presence of this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a missing release of references to "struct net_device" during the NETDEV_UNREGISTER event in the xfrm subsystem.
Immediate mitigation involves ensuring that the kernel includes the fix which re-introduces the xfrm_dev_unregister() function to unconditionally flush state and policy, thereby releasing the references properly.
Until the fix is applied, avoid configurations or operations that trigger the NETDEV_UNREGISTER event without proper cleanup, such as hardware offloading with NETIF_F_HW_ESP bit changes after xfrm_dev_state_add() has acquired references.
Monitoring and avoiding the use of IPsec hardware offloading features that may trigger this issue can reduce the risk.