CVE-2026-23342

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix race in cpumap on PREEMPT_RT

On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed

concurrently by multiple preemptible tasks on the same CPU.

The original code assumes bq_enqueue() and __cpu_map_flush() run

atomically with respect to each other on the same CPU, relying on

local_bh_disable() to prevent preemption. However, on PREEMPT_RT,

local_bh_disable() only calls migrate_disable() (when

PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable

preemption, which allows CFS scheduling to preempt a task during

bq_flush_to_queue(), enabling another task on the same CPU to enter

bq_enqueue() and operate on the same per-CPU bq concurrently.

This leads to several races:

1. Double __list_del_clearprev(): after bq->count is reset in

bq_flush_to_queue(), a preempting task can call bq_enqueue() ->

bq_flush_to_queue() on the same bq when bq->count reaches

CPU_MAP_BULK_SIZE. Both tasks th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References