Skip to main content

Linux Kernel EUVDEUVD-2026-27639

| CVE-2026-43115 MEDIUM
2026-05-06 Linux GHSA-vj6f-v49f-r83x
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local user access
  2. Delivery
    Load or invoke SRCU user-space interface
  3. Exploit
    Call srcu_gp_start_if_needed() while scheduler locks held
  4. Execution
    Trigger circular lock dependency
  5. Persist
    Workqueue pool→lock and pi_lock deadlock
  6. Impact
    System hang or panic

Vulnerability Assessment

Exploitation Conditions

Local authenticated user access required (CVE CVSS PR:L). Exploitation requires invoking call_srcu() or related tiny SRCU functions while the kernel simultaneously holds scheduler locks (pi_lock or similar). This typically occurs only in systems using user-space RCU libraries, kernel modules that call SRCU from within scheduler-held contexts, or targeted fuzzing. Default Linux installations without explicit RCU user-space code are not vulnerable in practice. Non-tiny SRCU implementations (tree SRCU) use different grace-period start mechanisms and are not affected.
Impact

CVSS score of 5.5 with local authenticated access requirement (AV:L/AC:L/PR:L) indicates moderate severity, but real-world risk is significantly lower per EPSS score of 0.02% (5th percentile). The vulnerability requires specific conditions: an attacker must be a local user capable of calling kernel interfaces (such as user-space RCU applications), and the system must execute call_srcu() while scheduler locks are held - a race condition requiring precise timing or deliberate orchestration. The absence from CISA KEV and low EPSS percentile suggest this is a theoretical kernel logic bug rather than an actively exploited vulnerability. Impact is availability (system hang/crash), not confidentiality or integrity. For systems running typical user workloads without explicit RCU user-space code, exploitation is unlikely. Systems with custom kernel modules or user-space RCU libraries face higher risk.
Exploit ScenarioDerived

A local attacker with user-level access executes a custom application that calls SRCU user-space synchronization primitives (e.g., via sys_rcu syscall or kernel module interface) while the kernel holds the scheduler pi_lock, triggering the circular lock dependency and causing the system to hang. The attack requires either knowledge of kernel lock ordering or repeated invocations that probabilistically collide with lock-held execution windows.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 08, 2026

Denial of service in Linux kernel tiny SRCU (Synchronize-RCU) subsystem allows local authenticated attackers to trigger a system hang or crash by invoking call_srcu() while holding scheduler locks, causing a circular lock dependency and potential deadlock. The vulnerability affects kernel versions before 6.19.14 and 7.0, with EPSS score of 0.02% indicating low real-world exploitation probability despite moderate CVSS severity.

RemediationAI

Upgrade to Linux kernel 6.19.14, 7.0, or later. Vendor-released patches are available at https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc and https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af. For systems unable to patch immediately, restrict local user access to RCU-related kernel interfaces and disable user-space RCU libraries if not required - this eliminates the attack surface by preventing call_srcu() invocations from user context. However, this mitigation may break legitimate RCU-dependent applications, so evaluate dependencies before implementation. Monitor system logs for RCU timeout warnings as an indicator of lock contention. Backports should be applied to any stable kernel branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.9.x) in use.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <bb37286db65368cb72ba8757ad86299c4e4a73fc
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a6fc88b22bc8d12ad52e8412c667ec0f5bf055af
Linux patch: 6.19.14
Linux patch: 7.0

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Tiny SRCU is a minimal read-copy-update synchronization primitive in the Linux kernel used for low-overhead RCU callbacks. The vulnerability exists in srcu_gp_start_if_needed(), which directly calls schedule_work() to start grace periods. The schedule_work() function acquires the workqueue pool->lock, creating a circular lock dependency when call_srcu() is invoked while the kernel holds the pi_lock (priority-inheritance lock used by the process scheduler). The fix replaces schedule_work() with irq_work, which defers pool->lock acquisition to a safe context, breaking the lock ordering cycle. Additionally, irq_work_sync() is added to cleanup_srcu_struct() to prevent use-after-free conditions.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
CVSS changed
May 08, 2026 - 17:52 NVD
5.5 (MEDIUM)
CVE Published
May 06, 2026 - 07:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

srcu: Use irq_work to start GP in tiny SRCU

Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock.

This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to:

call_srcu() [holding pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool->lock

workqueue_init() / create_worker() [holding pool->lock] wake_up_process() -> try_to_wake_up() -> pi_lock

Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins.

Tested with rcutorture SRCU-T and no lockdep warnings.

[ Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work to start process_srcu()" ]

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43115 ADVISORY https://vuldb.com/vuln/361346 REF https://git.kernel.org/stable/c/20b98d9ffb09763048a7c84b47403eb0f177272c REF https://git.kernel.org/stable/c/2127e6b79d9d579ea538a350d1bbe859e39814d5 REF https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488 REF https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af REF https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy