Skip to main content

Linux Kernel CVE-2026-43234

| EUVDEUVD-2026-27793 MEDIUM
2026-05-06 Linux GHSA-fgqh-8xwq-c3jp
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with CAP_NET_ADMIN required; no confidentiality or integrity impact, only kernel availability disruption via device reference leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:56 vuln.today
CVSS changed
May 12, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

team: avoid NETDEV_CHANGEMTU event when unregistering slave

syzbot is reporting

unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3 ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_hold include/linux/netdevice.h:4429 [inline] inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286 inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline] netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886 netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907 dev_set_mtu+0x126/0x260 net/core/dev_api.c:248 team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333 team_del_slave drivers/net/team/team_core.c:1936 [inline] team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline] call_netdevice_notifiers net/core/dev.c:2295 [inline] __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592 do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060 rtnl_changelink net/core/rtnetlink.c:3776 [inline] __rtnl_newlink net/core/rtnetlink.c:3935 [inline] rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894

problem. Ido Schimmel found steps to reproduce

ip link add name team1 type team ip link add name dummy1 mtu 1499 master team1 type dummy ip netns add ns1 ip link set dev dummy1 netns ns1 ip -n ns1 link del dev dummy1

and also found that the same issue was fixed in the bond driver in commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when unregistering slave").

Let's do similar thing for the team driver, with commit ad7c7b2172c3 ("net: hold netdev instance lock during sysfs operations") and commit 303a8487a657 ("net: s/__dev_set_mtu/__netif_set_mtu/") also applied.

AnalysisAI

Denial of service in the Linux kernel team network driver arises when a slave interface is moved to a different network namespace and then deleted, causing team_port_del() to fire a spurious NETDEV_CHANGEMTU event during slave unregistration that prompts inetdev_init() to acquire an unreleased reference on the device. This reference leak prevents the device from completing unregistration, hanging the kernel with 'unregister_netdevice: waiting for [device] to become free.' The bug is confined to local authenticated access and no public exploit exists (EPSS 0.02%, 4th percentile); however, the Linux kernel's ubiquitous deployment makes patch application broadly relevant. Upstream stable fixes are confirmed available in Linux 6.18.16, 6.19.6, and 7.0.

Technical ContextAI

The Linux kernel team driver (drivers/net/team/team_core.c), present since kernel 3.3, implements network port aggregation analogous to bonding. The vulnerable code path begins in team_port_del(), which calls dev_set_mtu() to restore a slave's original MTU when the slave is removed. This call triggers the NETDEV_CHANGEMTU notifier chain in net/core/dev.c, which dispatches to inetdev_event() in net/ipv4/devinet.c; if no IPv4 configuration exists for the device at that moment, inetdev_event() calls inetdev_init(), which calls netdev_hold() to acquire a reference on the network device. When this sequence occurs during slave unregistration triggered by a namespace move (__dev_change_net_namespace), the device is already in a teardown state, and the extra reference is never released. The kernel then loops indefinitely. The identical flaw was previously fixed in the bonding driver via commit f51048c3e07b ('bonding: avoid NETDEV_CHANGEMTU event when unregistering slave'), and related infrastructure commits ad7c7b2172c3 and 303a8487a657 are prerequisites for the team driver fix. CPE cpe:2.3:a:linux:linux covers all affected versions. No CWE was formally assigned; the root cause maps conceptually to CWE-772 (Missing Release of Resource after Effective Lifetime) due to incorrect event emission during device lifecycle teardown.

RemediationAI

The primary fix is upgrading to a patched kernel: Linux 6.18.16, 6.19.6, or 7.0. The three upstream stable commits confirmed at https://git.kernel.org/stable/c/bce42728ac4887060a24a585c5122fbd24939db7, https://git.kernel.org/stable/c/5268892de70f0b29bde341db863b234aa9259c08, and https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32 should be applied by distribution maintainers; Red Hat and SUSE users should monitor vendor channels for updated kernel packages. As compensating controls where patching is not immediately possible: restricting CAP_NET_ADMIN to trusted processes via seccomp or capability bounding sets prevents untrusted local users from creating team interfaces and triggering the bug, at the cost of breaking any unprivileged network management; disabling unprivileged user namespace creation with 'sysctl -w kernel.unprivileged_userns_clone=0' (on distributions that support this sysctl) significantly reduces exposure but breaks container runtimes that rely on unprivileged namespaces; blacklisting the team kernel module ('echo blacklist team >> /etc/modprobe.d/blacklist.conf' followed by unloading with 'modprobe -r team') eliminates the vulnerable code path entirely but disables network teaming functionality.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43234 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy