CVE-2026-23393

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: Fix race condition in peer_mep deletion

When a peer MEP is being deleted, cancel_delayed_work_sync() is called

on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in

softirq context under rcu_read_lock (without RTNL) and can re-schedule

ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync()

returning and kfree_rcu() being called.

The following is a simple race scenario:

cpu0 cpu1

mep_delete_implementation()

cancel_delayed_work_sync(ccm_rx_dwork);

br_cfm_frame_rx()

// peer_mep still in hlist

if (peer_mep->ccm_defect)

ccm_rx_timer_start()

queue_delayed_work(ccm_rx_dwork)

hlist_del_rcu(&peer_mep->hea

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References