CVE-2026-43374

In the Linux kernel, the following vulnerability has been resolved:

net: nexthop: fix percpu use-after-free in removenhgrp_entry

When removing a nexthop from a group, removenhgrpentry() publishes the new group via rcuassignpointer() then immediately frees the removed entry's percpu stats with freepercpu(). However, the synchronizenet() grace period in the caller removenexthopfromgroups() runs after the free. RCU readers that entered before the publish still see the old group and can dereference the freed stats via nhgrpentrystatsinc() -> getcpuptr(nhge->stats), causing a use-after-free on percpu memory.

Fix by deferring the freepercpu() until after synchronizenet() in the caller. Removed entries are chained via nh_list onto a local deferred free list. After the grace period completes and all RCU readers have finished, the percpu stats are safely freed.