CVE-2026-43167 is a Linux kernel vulnerability involving the xfrm subsystem where state and policy are not properly flushed upon NETDEV_UNREGISTER events. This leads to a reference count leak of the struct xfrm_state, causing network device unregistration to hang due to unreleased references. The issue stems from improper handling of hardware offload state references and missing cleanup in the unregister event handler.