Junglewise Threat Intelligence

CVE-2026-23463: Linux Kernel race condition in NXP QMan qman_destroy_fq

CVE-2026-23463 · Severity: medium · CVSS 4.7 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition in the Linux kernel's NXP QMan driver could allow a local attacker to cause a system crash or instability. The issue occurs when the system simultaneously tries to create and destroy frame queues, which are components used for network data processing. This vulnerability primarily impacts system availability and operational reliability.

Technical details

A race condition exists in the NXP QMan (qbman) driver within the Linux kernel when QMAN_FQ_FLAG_DYNAMIC_FQID is enabled. The vulnerability occurs in qman_destroy_fq() because the Frame Queue ID (FQID) is freed back to the pool before the corresponding entry in fq_table is cleared. This allows a concurrent call to qman_create_fq() to allocate the same FQID and attempt to populate the fq_table entry while it is still occupied, triggering a WARN_ON and potential state corruption. The fix involves reordering the operations and using a memory barrier (smp_wmb) to ensure the table entry is NULL before the ID is released for reuse.

Affected products

  • Linux Linux kernel 4.9 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-04-03: advisory: Initial disclosure via kernel.org and NVD
  • 2026-02-23: patched: Mainline patch committed

References

Related threats