Executive brief
A race condition exists in the Linux kernel's networking component when using Real-Time (PREEMPT_RT) configurations. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized actions by exploiting how the system handles network data packets. The issue specifically affects systems optimized for low-latency, real-time operations.
Technical details
A race condition exists in the BPF devmap component of the Linux kernel when running on PREEMPT_RT enabled systems. On these kernels, 'local_bh_disable()' does not disable preemption, allowing multiple tasks on the same CPU to concurrently access the per-CPU 'xdp_dev_bulk_queue' (bq). This concurrency leads to several issues: double-free/use-after-free of packet frames in 'bq->q[]', corruption of 'bq->count', and teardown races between 'bq_enqueue' and '__dev_flush'. An attacker with local access could exploit these races to cause a kernel panic or achieve memory corruption. The fix introduces a 'local_lock_t' to properly serialize access to the bulk queue on PREEMPT_RT systems.
Affected products
- Linux Linux Kernel 6.18 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1
Timeline
- 2026-03-25: advisory: Initial disclosure of CVE-2026-23294
- 2026-02-27: patched: Fix committed to mainline kernel by Alexei Starovoitov