CVE-2026-43115

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43115
In the Linux kernel, the following vulnerability has been resolved: srcu: Use irq_work to start GP in tiny SRCU Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock. This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to: call_srcu() [holding pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool->lock workqueue_init() / create_worker() [holding pool->lock] wake_up_process() -> try_to_wake_up() -> pi_lock Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins. Tested with rcutorture SRCU-T and no lockdep warnings. [ Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work to start process_srcu()" ]

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488
https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af Patch
https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
History

11 Nov 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: srcu: Usar irq_work para iniciar GP en tiny SRCU El srcu_gp_start_if_needed() de Tiny SRCU llama directamente a schedule_work(), que adquiere el pool -> lock de la workqueue. Esto causa un lockdep splat cuando se llama a call_srcu() con un bloqueo del planificador mantenido, debido a: call_srcu() [manteniendo pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool -> lock workqueue_init() / create_worker() [manteniendo pool -> lock] wake_up_process() -> try_to_wake_up() -> pi_lock También añadir irq_work_sync() a cleanup_srcu_struct() para prevenir un uso después de liberación si un irq_work en cola se dispara después de que comience la limpieza. Probado con rcutorture SRCU-T y sin advertencias de lockdep. [ Gracias a Boqun por una corrección similar en el parche ’rcu: Usar un irq_work intermedio para iniciar process_srcu()’ ]

30 Oct 2026, 13:18

Type Values Removed Values Added
References
  • {'url': 'https://git.kernel.org/stable/c/20b98d9ffb09763048a7c84b47403eb0f177272c', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://git.kernel.org/stable/c/2127e6b79d9d579ea538a350d1bbe859e39814d5', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

21 Oct 2026, 13:18

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/20b98d9ffb09763048a7c84b47403eb0f177272c -
  • () https://git.kernel.org/stable/c/2127e6b79d9d579ea538a350d1bbe859e39814d5 -

15 Oct 2026, 11:17

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488 -
Information

Published : 2026-05-06 10:16

Updated : 2026-11-11 21:10

NVD link : CVE-2026-43115

Mitre link : CVE-2026-43115

CVE.ORG link : CVE-2026-43115

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo