SB20260325166 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Linux kernel bpf

Description

This security bulletin contains information about 1 security vulnerability.

1) Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-ID: CVE-2026-23294)

The vulnerability allows a local user to execute arbitrary code, escalate privileges, or cause a denial of service.

The vulnerability exists due to improper synchronization in the BPF device map (devmap) component when handling XDP frame transmission on PREEMPT_RT kernels. A local user can trigger concurrent access to the per-CPU xdp_dev_bulk_queue structure by exploiting preemption during bulk transmission operations, leading to use-after-free, memory corruption, and list manipulation races.

The issue arises specifically on PREEMPT_RT-enabled systems where local_bh_disable() does not prevent task preemption, allowing multiple tasks on the same CPU to simultaneously access shared queue structures.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1872e75375c40add4a35990de3be77b5741c252c
• https://git.kernel.org/stable/c/6c10b019785dc282c5f45d21e4a3f468b8fd6476
• https://git.kernel.org/stable/c/ab1a56c9d99189aa5c6e03940d06e40ba6a28240