Linux: Improper Locking
CVE-2026-43469 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 7ea69259a60a364f56cf4aa9e2eafb588d1c762b, 8cb6b5d8296b1f99a8d36849901ebabfe3f749db, 74c39a47856bddcde7874f2196a00143b5cd0af9 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.4% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 7ea69259a60a364f56cf4aa9e2eafb588d1c762b or 8cb6b5d8296b1f99a8d36849901ebabfe3f749db or 74c39a47856bddcde7874f2196a00143b5cd0af9 or 49f53ee4e25297d886f14e31f355ad1c2735ddfb, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.203 or 6.1.167 or 6.6.130 or 6.12.78, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 15788d1d1077ebe029c48842c738876516d85076 up to, but not including, 7ea69259a60a364f56cf4aa9e2eafb588d1c762b; 15788d1d1077ebe029c48842c738876516d85076 up to, but not including, 8cb6b5d8296b1f99a8d36849901ebabfe3f749db; 15788d1d1077ebe029c48842c738876516d85076 up to, but not including, 74c39a47856bddcde7874f2196a00143b5cd0af9; 15788d1d1077ebe029c48842c738876516d85076 up to, but not including, 49f53ee4e25297d886f14e31f355ad1c2735ddfb; 15788d1d1077ebe029c48842c738876516d85076 up to, but not including, 8127b5fec04757c2a41ed65bca0b3266968efd3b; 15788d1d1077ebe029c48842c738876516d85076 up to, but not including, dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf; 15788d1d1077ebe029c48842c738876516d85076 up to, but not including, 7b6275c80a0c81c5f8943272292dfe67730ce849; 5.13 | 7ea69259a60a364f56cf4aa9e2eafb588d1c762b, 8cb6b5d8296b1f99a8d36849901ebabfe3f749db, 74c39a47856bddcde7874f2196a00143b5cd0af9, 49f53ee4e25297d886f14e31f355ad1c2735ddfb, 8127b5fec04757c2a41ed65bca0b3266968efd3b, dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf |
| Linux | Linux Kernel | 5.13 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.19; 6.19 up to, but not including, 6.19.9; 7.0 | 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decrement re_receiving on the early exit paths In the event that rpcrdma_post_recvs() fails to create a work request (due to memory allocation failure, say) or otherwise exits early, we should decrement ep->re_receiving before returning. Otherwise we will hang in rpcrdma_xprt_drain() as re_receiving will never reach zero and the completion will never be triggered. On a system with high memory pressure, this can appear as the following hung task: INFO: task kworker/u385:17:8393 blocked for more than 122 seconds. Tainted: G S E 6.19.0 #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u385:17 state:D stack:0 pid:8393 tgid:8393 ppid:2 task_flags:0x4248060 flags:0x00080000 Workqueue: xprtiod xprt_autoclose [sunrpc] Call Trace: <TASK> __schedule+0x48b/0x18b0 ? ib_post_send_mad+0x247/0xae0 [ib_core] schedule+0x27/0xf0 schedule_timeout+0x104/0x110 __wait_for_common+0x98/0x180 ? __pfx_schedule_timeout+0x10/0x10 wait_for_completion+0x24/0x40 rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma] xprt_rdma_close+0x12/0x40 [rpcrdma] xprt_autoclose+0x5f/0x120 [sunrpc] process_one_work+0x191/0x3e0 worker_thread+0x2e3/0x420 ? __pfx_worker_thread+0x10/0x10 kthread+0x10d/0x230 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x273/0x2b0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/49f53ee4e25297d886f14e31f355ad1c2735ddfb
- git.kernel.org/stable/c/74c39a47856bddcde7874f2196a00143b5cd0af9
- git.kernel.org/stable/c/7b6275c80a0c81c5f8943272292dfe67730ce849
- git.kernel.org/stable/c/7ea69259a60a364f56cf4aa9e2eafb588d1c762b
- git.kernel.org/stable/c/8127b5fec04757c2a41ed65bca0b3266968efd3b
- git.kernel.org/stable/c/8cb6b5d8296b1f99a8d36849901ebabfe3f749db
- git.kernel.org/stable/c/dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf
Recent Improper Locking vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 8.8 High severity
- 7.8 High severity
- 7.5 High severity
- 7.8 High severity
Spotted an error? Tell us.