CVE-2026-43234
Use-After-Free in Linux Kernel Team Driver
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves an issue with the network device management, specifically related to the 'team' network driver. The problem occurs when unregistering a slave device from a team device, where the system waits for the device to become free but encounters a usage count that prevents proper release.
The root cause is related to the NETDEV_CHANGEMTU event being triggered during the unregistering process, which leads to a deadlock or hang situation. The vulnerability was identified through a sequence of commands that create a team device, add a dummy device as a slave, move it to a network namespace, and then delete it, causing the issue.
The fix involved avoiding the NETDEV_CHANGEMTU event when unregistering the slave device, similar to a previous fix applied to the bonding driver, and holding the netdev instance lock during sysfs operations.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to hang or deadlock when network devices are being unregistered, specifically in configurations using the team network driver with slave devices.
Such a hang can lead to system instability, degraded network performance, or denial of service conditions where network interfaces become unresponsive or cannot be properly managed.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability relates to the Linux kernel's network device handling, specifically involving the team driver and MTU change events during device unregistration.
Detection can be attempted by reproducing the conditions that trigger the issue, which involve creating a team device and a dummy device with specific MTU settings, moving the dummy device into a network namespace, and then deleting it.
- ip link add name team1 type team
- ip link add name dummy1 mtu 1499 master team1 type dummy
- ip netns add ns1
- ip link set dev dummy1 netns ns1
- ip -n ns1 link del dev dummy1
Observing kernel logs for messages such as "unregister_netdevice: waiting for netdevsim0 to become free" or reference count warnings related to netdevice usage can also indicate the presence of this issue.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by applying specific patches to the Linux kernel's team driver, similar to fixes applied to the bond driver.
Immediate mitigation involves updating the Linux kernel to a version that includes the following commits:
- Commit f51048c3e07b - "bonding: avoid NETDEV_CHANGEMTU event when unregistering slave"
- Commit ad7c7b2172c3 - "net: hold netdev instance lock during sysfs operations"
- Commit 303a8487a657 - "net: s/__dev_set_mtu/__netif_set_mtu/"
Until the kernel is updated, avoid operations that trigger the unregistering of slave devices in the team driver, such as deleting dummy devices in network namespaces that are slaves to team devices.