CVE-2026-23294

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix race in devmap on PREEMPT_RT

On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_queue (bq) can be

accessed concurrently by multiple preemptible tasks on the same CPU.

The original code assumes bq_enqueue() and __dev_flush() run atomically

with respect to each other on the same CPU, relying on

local_bh_disable() to prevent preemption. However, on PREEMPT_RT,

local_bh_disable() only calls migrate_disable() (when

PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable

preemption, which allows CFS scheduling to preempt a task during

bq_xmit_all(), enabling another task on the same CPU to enter

bq_enqueue() and operate on the same per-CPU bq concurrently.

This leads to several races:

1. Double-free / use-after-free on bq->q[]: bq_xmit_all() snapshots

cnt = bq->count, then iterates bq->q[0..cnt-1] to transmit frames.

If preempted after the snapshot, a second task can call bq_enqueue()

-> bq_xmit_all() o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References