CVE-2026-23126
Race Condition in Linux netdevsim Driver Causes Kernel Crash
Publication date: 2026-02-14
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.122 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.68 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 4.16 (inc) to 6.1.162 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Linux kernel to a version where this race condition in the netdevsim driver has been fixed. The fix involves adding a mutex lock to prevent simultaneous addition and deletion operations on the bpf_bound_progs list.
Until the kernel is updated, avoid using the netdevsim driver or any features that trigger operations on the bpf_bound_progs list to reduce the risk of kernel crashes.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's netdevsim driver, where there is a race condition related to operations on the bpf_bound_progs list.
Specifically, when the function nsim_bpf_create_prog() adds an entry to the list using list_add_tail, it can happen simultaneously with nsim_bpf_destroy_prog() removing an entry using list_del.
Because there is no protection mechanism like a mutex lock around these operations, concurrent modifications can corrupt the list, leading to a kernel crash.
The fix involved adding a mutex lock to prevent simultaneous addition and deletion operations on the list.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to list corruption when concurrent operations occur on the bpf_bound_progs list in the netdevsim driver.
A kernel crash can lead to system instability, downtime, and potential loss of data or service availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for kernel crash messages related to list corruption in the netdevsim driver. Specifically, look for kernel BUG messages referencing list_debug.c and invalid opcode errors triggered by concurrent operations on the bpf_bound_progs list.
You can check the kernel logs using commands such as:
- dmesg | grep -i 'kernel BUG'
- journalctl -k | grep -i 'list_debug.c'
- journalctl -k | grep -i 'netdevsim'
These commands help identify if the kernel has encountered the specific crash caused by the race condition in the netdevsim driver.