CVE-2026-23342
Race Condition in Linux Kernel BPF cpumap on PREEMPT_RT
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | From 6.18.1 (inc) to 6.18.17 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's handling of the per-CPU xdp_bulk_queue (bq) on PREEMPT_RT kernels. The issue arises because multiple preemptible tasks on the same CPU can concurrently access the bq, which was originally assumed to be accessed atomically. The original code relied on local_bh_disable() to prevent preemption, but on PREEMPT_RT kernels, this does not actually disable preemption, allowing tasks to be preempted and concurrently operate on the same bq.
This concurrency leads to race conditions such as double calls to __list_del_clearprev() on the same flush_node, which can cause kernel crashes (kernel oops), and corruption of the packet queue due to concurrent modifications of bq->count and bq->q[].
The fix involves adding a local_lock_t to the xdp_bulk_queue and acquiring this lock in both bq_enqueue() and __cpu_map_flush() functions to serialize access and prevent these race conditions.
How can this vulnerability impact me? :
This vulnerability can lead to kernel crashes (kernel oops) due to race conditions in the packet queue handling on PREEMPT_RT Linux kernels. Such crashes can cause system instability, unexpected reboots, or denial of service conditions.
Additionally, corruption of the packet queue could potentially disrupt network packet processing, leading to degraded network performance or loss of network data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a race condition in the Linux kernel's bpf cpumap implementation on PREEMPT_RT kernels, specifically in the per-CPU xdp_bulk_queue (bq). Detection involves reproducing the race condition by inserting a delay between bq->count = 0 and __list_del_clearprev() in bq_flush_to_queue() and running the reproducer provided by syzkaller.
Since this is a kernel-level race condition, direct detection on a running system may require kernel debugging or reproducing the issue with specialized test code such as syzkaller reproducer.
No specific commands are provided in the available information to detect this vulnerability on a live system or network.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by adding a local_lock_t to the xdp_bulk_queue and acquiring it in bq_enqueue() and __cpu_map_flush() to serialize access to the queue on PREEMPT_RT kernels.
Immediate mitigation steps include updating the Linux kernel to a version that contains this fix.
If updating is not immediately possible, avoiding the use of PREEMPT_RT kernels or disabling features that trigger this code path may reduce exposure, though no specific workaround commands are provided.