CVE-2026-23340

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs

When shrinking the number of real tx queues,

netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush

qdiscs for queues which will no longer be used.

qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with

qdisc_lock(). However, for lockless qdiscs, the dequeue path is

serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so

qdisc_reset() can run concurrently with __qdisc_run() and free skbs

while they are still being dequeued, leading to UAF.

This can easily be reproduced on e.g. virtio-net by imposing heavy

traffic while frequently changing the number of queue pairs:

iperf3 -ub0 -c $peer -t 0 &

while :; do

ethtool -L eth0 combined 1

ethtool -L eth0 combined 2

done

With KASAN enabled, this leads to reports like:

BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760

...

Call T

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References