CVE-2026-43071 Linux CVE debrief

Who should care

Linux kernel maintainers, system administrators, cloud infrastructure operators, embedded device manufacturers, and security teams responsible for kernel hardening and boot-time security

Technical summary

The Linux kernel's dcache_init() function computes d_hash_shift based on the number of dentry_hashtable buckets, which is derived from the dhash_entries boot parameter. When dhash_entries=1, only one bucket is allocated and d_hash_shift becomes 32. In __d_lookup(), the bucket index is computed as (u32)hashlen >> d_hash_shift. A right shift of a 32-bit unsigned integer by 32 bits is undefined behavior in C; on affected compilers and architectures, this evaluates to the unshifted hashlen value, producing an index far beyond the allocated single bucket. The subsequent hlist_bl_for_each_entry_rcu() iteration dereferences h->first on this invalid bucket pointer, causing a page fault and kernel Oops. The fix limits the minimum bucket count to two, ensuring d_hash_shift is at most 31 and the shift operation remains well-defined.

Defensive priority

critical

Recommended defensive actions

• Apply the appropriate stable kernel patch from the Linux kernel stable tree to enforce a minimum of two dentry_hashtable buckets
• Audit boot parameters across all Linux systems to identify any use of dhash_entries=1 and remove or modify such configurations until patched
• Prioritize patching for systems with network-exposed kernel interfaces or untrusted user namespaces where dentry operations may be attacker-influenced
• Monitor for kernel page faults in __d_lookup or d_lookup.cold as potential indicators of exploitation attempts or misconfigurations
• Review kernel crash dumps and early-boot logs for Oops traces involving dentry_hashtable access on systems with non-default dhash_entries values

Evidence notes

The vulnerability description and patch references confirm the root cause: undefined behavior from a 32-bit right shift on a u32 when dhash_entries=1 causes d_hash_shift=32, leading to OOB memory access in dentry_hashtable during __d_lookup(). The call trace demonstrates exploitation path through debugfs directory creation at boot. Multiple stable kernel patches are available across affected branches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.