CVE-2026-43115 Linux CVE debrief

Who should care

Linux kernel maintainers and users, particularly those using Linux kernel versions 4.12 through 6.19.14, as well as 7.0 rc1 through rc5, should assess exposure and apply patches to prevent potential lockdep warnings.

Why it matters

A vulnerability in the Linux kernel's tiny SRCU implementation can cause a lockdep splat when call_srcu() is called with a scheduler lock held. Defenders should assess exposure and apply patches to prevent potential lockdep warnings.

• Defenders should verify Linux kernel versions 4.12 through 6.19.14, as well as 7.0 rc1 through rc5, for potential exposure.
• Systems using the affected Linux kernel versions may experience lockdep warnings if the vulnerability is not patched.
• Applying patches provided by the Linux kernel maintainers can prevent potential lockdep warnings.

Technical summary

The Linux kernel's tiny SRCU implementation has a vulnerability that can cause a lockdep splat when call_srcu() is called with a scheduler lock held. The issue arises from srcu_gp_start_if_needed() directly calling schedule_work(), which acquires the workqueue pool->lock. To address this, the kernel now uses irq_work to start the grace period in tiny SRCU. Additionally, irq_work_sync() is added to cleanup_srcu_struct() to prevent use-after-free if a queued irq_work fires after cleanup begins.

Defensive priority

Linux kernel maintainers and users should assess exposure and apply patches to prevent potential lockdep warnings. Priority should be given to systems using Linux kernel versions 4.12 through 6.19.14, as well as 7.0 rc1 through rc5.

Recommended defensive actions

• Review Linux kernel versions 4.12 through 6.19.14, as well as 7.0 rc1 through rc5, for potential exposure.
• Apply patches provided by the Linux kernel maintainers to address the vulnerability.
• Monitor systems using Linux kernel versions 4.12 through 6.19.14, as well as 7.0 rc1 through rc5, for potential lockdep warnings.
• Perform asset inventory to identify systems running Linux kernel versions 4.12 through 6.19.14, as well as 7.0 rc1 through rc5.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets.
• Review vendor patch guidance for Linux kernel versions 4.12 through 6.19.14, as well as 7.0 rc1 through rc5.

Evidence notes

The CVE record and NVD details provide information on the vulnerability and its resolution in the Linux kernel. The issue is related to the tiny SRCU implementation and its interaction with scheduler locks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.