CVE-2026-43374 is a use-after-free vulnerability in the Linux kernel's nexthop group removal code. The flaw occurs when percpu statistics memory is freed before the RCU grace period completes, allowing RCU readers to access freed memory. This can lead to memory corruption and potentially escalate to system compromise. The issue is fixed by deferring the freeing of percpu stats until after the RCU grace period.