kthread: consolidate kthread exit paths to prevent use-after-free
In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread exit paths to prevent use-after-free Guillaume reported crashes via corrupted RCU callback function pointers during KUnit testing. The crash was traced back to the pidfs rhashtable conversion which replaced the 24-byte rb_node with an 8-byte rhash_head in struct pid, shrinking it from 160 to 144 bytes. struct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to 192 bytes and share the same slab cache. struct pid.rcu.func and struct kthread.affinity_node both sit at offset 0x78. When a kthread exits via make_task_dead() it bypasses kthread_exit() and misses the affinity_node cleanup. free_kthread_struct() frees the memory while the node is still linked into the global kthread_affinity_list. A subsequent list_del() by another kthread writes through dangling list pointers into the freed and reused memory, corrupting the pid's rcu.func pointer. Instead of patching free_kthread_struct() to handle the missed cleanup, consolidate all kthread exit paths. Turn kthread_exit() into a macro that calls do_exit() and add kthread_do_exit() which is called from do_exit() for any task with PF_KTHREAD set. This guarantees that kthread-specific cleanup always happens regardless of the exit path - make_task_dead(), direct do_exit(), or kthread_exit(). Replace __to_kthread() with a new tsk_is_kthread() accessor in the public head
CVE-2026-43402
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43402
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4d13f4304fa43471bfea101658a11feec7b28ac0",
"lessThan": "4729c7b00a347fd37d0cbc265b85f2884c3e06b6",
"versionType": "git"
},
{
"status": "affected",
"version": "4d13f4304fa43471bfea101658a11feec7b28ac0",
"lessThan": "5a591d7a5e48d30100943940a30a6ab41b15c672",
"versionType": "git"
},
{
"status": "affected",
"version": "4d13f4304fa43471bfea101658a11feec7b28ac0",
"lessThan": "28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f",
"versionType": "git"
}
],
"programFiles": [
"include/linux/kthread.h",
"kernel/exit.c",
"kernel/kthread.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/linux/kthread.h",
"kernel/exit.c",
"kernel/kthread.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-43402
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #40071 · Revision 1
- Added to Heist Feed
- Publisher date