Linux Kernel CVE-2026-43091

Local access with low-level privilege authentication required (CVSS PR:L). Attacker must have capability to create or manipulate network namespaces, typically available to unprivileged users on systems with kernel.unprivileged_userns_clone enabled (default on many distributions) or to processes within containers having CAP_NET_ADMIN capability. Exploitation requires precise timing to win the race between xfrm_policy_fini() freeing the hash table and concurrent RCU readers accessing it-achievable through multithreading but not deterministic. Most effective on systems under heavy XFRM policy churn or in container orchestration environments where namespace lifecycle operations are frequent. Attack complexity is rated low (AC:L) because once local access and namespace capabilities are obtained, no additional complexity barriers exist. Limiting factors: local attack vector prevents remote exploitation; requires authenticated access ruling out anonymous attackers; race condition timing is non-deterministic requiring multiple attempts; modern kernel exploit mitigations (KASLR, SMAP, SMEP) increase complexity of converting memory corruption to code execution.

Real-world risk is moderate despite CVSS 7.8 (High) severity. The CVSS vector AV:L/AC:L/PR:L indicates local access with low-privilege authentication required and low attack complexity, making this exploitable by local users or malicious containers. However, EPSS score of 0.02% (5th percentile) suggests extremely low probability of mass exploitation in the wild. No CISA KEV listing and no publicly available exploit code further reduces immediate threat. The vulnerability requires specific exploitation conditions: attacker must trigger network namespace teardown (common in container environments) while simultaneously racing RCU readers to access freed policy structures-technically feasible but requiring precise timing. SSVC factors: exploitation status is none public, automatable is no (requires local access and timing), technical impact is total (arbitrary code execution as kernel). Primary risk surfaces are multi-tenant container platforms and systems with untrusted local users. The discrepancy between high CVSS and low EPSS reflects that while impact is severe, the local attack vector and timing requirements significantly constrain real-world exploitability. Priority should be elevated for container orchestration platforms (Kubernetes, OpenShift) and shared hosting environments, but can be standard patch cycle for single-tenant systems with trusted local users.

A malicious local user or compromised container on a multi-tenant system creates a network namespace and populates it with XFRM policies for IPsec tunnels. The attacker then triggers namespace teardown via the unshare/setns system calls while simultaneously spawning threads that perform rapid policy lookups via netlink sockets. During the race window between xfrm_policy_fini() freeing the policy_bydst hash table and RCU readers exiting their critical sections, the attacker's lookup threads access the freed memory region. By controlling the timing and leveraging heap spraying techniques, the attacker overwrites freed memory with malicious data structures containing function pointers, achieving arbitrary code execution in kernel context (ring 0) with full system privileges. No public exploit identified at time of analysis, but the primitives (namespace creation, netlink policy manipulation) are readily available to authenticated users.