Use-after-free in Linux kernel - CVE-2026-43163

Vulnerability identifier: #VU130570

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-43163

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in write_page() when resizing an array while bitmap daemon work is iterating over bitmap->storage.filemap. A local user can trigger concurrent bitmap update and resize operations to cause a denial of service.

The issue occurs because the md thread can continue running during quiesce(), allowing concurrent access to freed pages.

Linux kernel
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Ubuntu
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-modules-extra
kernel-debug-core
kernel-debug
kernel-cross-headers
kernel-core
kernel
bpftool
kernel-debug-devel
kernel-debug-modules
kernel-debug-modules-extra
kernel-devel
kernel-headers
kernel-modules
kernel-tools
kernel-tools-libs
kernel-tools-libs-devel
perf
python3-perf
kernel-abi-stablelists
kernel-doc
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-azure (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-azure-fde (Ubuntu package)
kernel-tools-debuginfo
python3-perf-debuginfo
perf-debuginfo
kernel-source
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
kernel-tools-devel
kernel-extra-modules
linux-hwe-6.8 (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-raspi (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-raspi-realtime (Ubuntu package)
kernel-tools-debuginfo (Red Hat package)
kernel-headers (Red Hat package)
kernel-devel-matched (Red Hat package)
kernel-devel (Red Hat package)
kernel-debuginfo-common-x86_64 (Red Hat package)
kernel-debug-devel-matched (Red Hat package)
kernel-debug-devel (Red Hat package)
kernel-zfcpdump-devel-matched (Red Hat package)
kernel-debuginfo-common-aarch64 (Red Hat package)
kernel-64k-devel-matched (Red Hat package)
kernel-64k-devel (Red Hat package)
kernel-64k-debuginfo (Red Hat package)
kernel-64k-debug-devel-matched (Red Hat package)
kernel-64k-debug-devel (Red Hat package)
kernel-64k-debug-debuginfo (Red Hat package)
kernel-debuginfo-common-ppc64le (Red Hat package)
perf (Red Hat package)
kernel-zfcpdump-devel (Red Hat package)
kernel-debuginfo-common-s390x (Red Hat package)
kernel-debuginfo (Red Hat package)
kernel-debug-debuginfo (Red Hat package)
rv (Red Hat package)
rtla (Red Hat package)
python3-perf (Red Hat package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel (Red Hat package) - addressed in versions 3.10.0-1160.151.1.el7, 4.18.0-305.194.1.el8_4, 4.18.0-477.147.1.el8_8, 4.18.0-553.126.1.el8_10, 5.14.0-284.174.1.el9_2, 5.14.0-427.127.1.el9_4
kernel-rt (Red Hat package) - addressed in versions 3.10.0-1160.155.1.rt56.1307.el7, 4.18.0-553.126.1.rt7.467.el8_10, 5.14.0-284.174.1.rt14.459.el9_2
kernel-modules-extra - update to 4.18.0-553.126.1.0.1
kernel-debug-core - update to 4.18.0-553.126.1.0.1
kernel-debug - update to 4.18.0-553.126.1.0.1
kernel-cross-headers - update to 4.18.0-553.126.1.0.1
kernel-core - update to 4.18.0-553.126.1.0.1
kernel - update to 4.18.0-553.126.1.0.1
bpftool - update to 4.18.0-553.126.1.0.1
kernel-debug-devel - update to 4.18.0-553.126.1.0.1
kernel-debug-modules - update to 4.18.0-553.126.1.0.1
kernel-debug-modules-extra - update to 4.18.0-553.126.1.0.1
kernel-devel - update to 4.18.0-553.126.1.0.1
kernel-headers - update to 4.18.0-553.126.1.0.1
kernel-modules - update to 4.18.0-553.126.1.0.1
kernel-tools - update to 4.18.0-553.126.1.0.1
kernel-tools-libs - update to 4.18.0-553.126.1.0.1
kernel-tools-libs-devel - update to 4.18.0-553.126.1.0.1
perf - update to 4.18.0-553.126.1.0.1
python3-perf - update to 4.18.0-553.126.1.0.1
kernel-abi-stablelists - update to 4.18.0-553.126.1.0.1
kernel-doc - update to 4.18.0-553.126.1.0.1
linux (Ubuntu package) - addressed in versions 5.15.0.184.155, 5.15.0-184.194, 5.15.0-184.194~20.04.1, 5.15.0.186.166, 5.15.0-186.196, 5.15.0-186.196~20.04.1, 5.15.0.1075.78, 5.15.0-1075.79, 5.15.0.1095.94, 5.15.0-1095.103, 5.15.0.1104.100, 5.15.0-1104.109, 5.15.0.1108.107, 5.15.0-1108.114, 5.15.0.1111.115, 5.15.0-1111.120+fips1, 5.15.0.1112.102, 5.15.0.1112.109, 5.15.0-1112.122, 5.15.0-1112.122+fips1, 6.8.0-134.134, 6.8.0-1057.58~22.04.1, 6.8.0-1058.61+fips1, 6.8.0-1058.61~22.04.1, 6.8.0-1060.61, 6.8.0-1060.63+fips1, 6.8.0-1060.63~22.04.1, 6.8.0-1063.69, 6.8.0-1063.69+fips1, 6.8.1-1055.56, 6.8.1-1055.56~22.04.1
linux-aws (Ubuntu package) - addressed in versions 5.15.0.186.109, 5.15.0-186.196+fips1, 5.15.0.1106.103, 5.15.0-1106.110, 5.15.0.1107.107, 5.15.0-1107.108, 5.15.0.1112.108, 5.15.0.1112.115, 5.15.0-1112.119, 5.15.0-1112.119+fips1, 5.15.0-1112.119~20.04.1
linux-nvidia-tegra (Ubuntu package) - addressed in versions 5.15.0-1053.53, 5.15.0.1053.55, 5.15.0.1064.64, 5.15.0-1064.66, 6.8.0-1029.30
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1064.66~20.04.1
linux-intel-iot-realtime (Ubuntu package) - addressed in versions 5.15.0-1104.106, 5.15.0.1104.108, 5.15.0-1107.113~20.04.1
linux-ibm-5.15 (Ubuntu package) - update to 5.15.0-1106.110~20.04.1
linux-intel-iotg (Ubuntu package) - addressed in versions 5.15.0.1107.106, 5.15.0-1107.113
linux-azure (Ubuntu package) - addressed in versions 5.15.0.1109.105, 5.15.0-1109.115, 5.15.0.1117.115, 5.15.0-1117.126, 6.8.0-1063.71, 6.8.0-1063.71~22.04.1
linux-azure-5.15 (Ubuntu package) - addressed in versions 5.15.0-1109.115~20.04.1, 5.15.0-1117.126~20.04.1, 5.15.0-1117.126~20.04.2
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1112.122~20.04.1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0.1117.102, 5.15.0-1117.126+fips1, 6.8.0-134.134+fips1, 6.8.0-1062.69+fips1
linux-azure-fde (Ubuntu package) - addressed in versions 5.15.0-1117.126, 6.8.0-1062.69
kernel-tools-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
python3-perf-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
python3-perf - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
perf-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
perf - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-tools - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-source - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-headers - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-devel - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-debugsource - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
bpftool-debuginfo - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
bpftool - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-tools-devel - addressed in versions 6.6.0-145.1.19.156, 6.6.0-145.3.14.145
kernel-extra-modules - update to 6.6.0-145.3.14.145
linux-hwe-6.8 (Ubuntu package) - update to 6.8.0-136.136~22.04.1
linux-aws-6.8 (Ubuntu package) - addressed in versions 6.8.0-1045.48, 6.8.0-1057.58~22.04.1, 6.8.0-1058.61.1, 6.8.0-1058.64, 6.8.0-1060.61~22.04.1, 6.8.0-1060.63~22.04.1, 6.8.0-1063.69~22.04.1
linux-raspi (Ubuntu package) - update to 6.8.0-1060.64
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1062.69~22.04.1
linux-raspi-realtime (Ubuntu package) - update to 6.8.0-2049.50
kernel-tools-debuginfo (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-headers (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-devel-matched (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-devel (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debuginfo-common-x86_64 (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debug-devel-matched (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debug-devel (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-zfcpdump-devel-matched (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debuginfo-common-aarch64 (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-64k-devel-matched (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-64k-devel (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-64k-debuginfo (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-64k-debug-devel-matched (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-64k-debug-devel (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-64k-debug-debuginfo (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debuginfo-common-ppc64le (Red Hat package) - update to 6.12.0-55.76.1.el10_0
perf (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-zfcpdump-devel (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debuginfo-common-s390x (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debuginfo (Red Hat package) - update to 6.12.0-55.76.1.el10_0
kernel-debug-debuginfo (Red Hat package) - update to 6.12.0-55.76.1.el10_0
rv (Red Hat package) - update to 6.12.0-55.76.1.el10_0
rtla (Red Hat package) - update to 6.12.0-55.76.1.el10_0
python3-perf (Red Hat package) - update to 6.12.0-55.76.1.el10_0

• https://git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7
• https://git.kernel.org/stable/c/46ef85f854dfa9d5226b3c1c46493d79556c9589
• https://git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c
• https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f
• https://git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89
• https://git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c
• https://git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec
• https://git.kernel.org/stable/c/ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8

• Use-after-free in Linux kernel md driver
• Red Hat Enterprise Linux 9 update for kernel
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel-rt
• Red Hat Enterprise Linux 10 update for kernel
• Red Hat Enterprise Linux 9 update for kernel-rt
• Anolis OS update for kernel:4.18
• Red Hat Enterprise Linux 9 update for kernel
• openEuler 24.03 LTS SP3 update for kernel
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for kernel
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel
• Ubuntu update for linux
• Ubuntu update for linux-nvidia-tegra
• Ubuntu update for linux-aws-6.8
• Ubuntu update for linux-raspi-realtime
• Ubuntu update for linux-raspi
• Ubuntu update for linux-azure-fips
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for kernel-rt
• Ubuntu update for linux-nvidia-tegra-5.15
• Ubuntu update for linux
• Ubuntu update for linux-ibm-5.15
• Ubuntu update for linux-nvidia-tegra
• Ubuntu update for linux-aws
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-fde-6.8
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-azure
• openEuler 24.03 LTS SP1 update for kernel
• Ubuntu update for linux-azure-5.15
• Ubuntu update for linux-hwe-6.8
• Ubuntu update for linux-azure-fips
• Ubuntu update for linux-intel-iot-realtime
• Ubuntu update for linux-intel-iotg
• Ubuntu update for linux-gcp-5.15