Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Linux kernel - CVE-2026-23294

Vulnerability details

The vulnerability allows a local user to execute arbitrary code, escalate privileges, or cause a denial of service.

The vulnerability exists due to improper synchronization in the BPF device map (devmap) component when handling XDP frame transmission on PREEMPT_RT kernels. A local user can trigger concurrent access to the per-CPU xdp_dev_bulk_queue structure by exploiting preemption during bulk transmission operations, leading to use-after-free, memory corruption, and list manipulation races.

The issue arises specifically on PREEMPT_RT-enabled systems where local_bh_disable() does not prevent task preemption, allowing multiple tasks on the same CPU to simultaneously access shared queue structures.

Affected software

How to mitigate CVE-2026-23294

External References

• https://git.kernel.org/stable/c/1872e75375c40add4a35990de3be77b5741c252c
• https://git.kernel.org/stable/c/6c10b019785dc282c5f45d21e4a3f468b8fd6476
• https://git.kernel.org/stable/c/ab1a56c9d99189aa5c6e03940d06e40ba6a28240

Related Security Bulletins

• Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Linux kernel bpf