Cloudanix VulnDB

CVE-2026-23126

Medium · 4.7

CVSS

4.7

EPSS

0.1%

Published

Feb 14, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux kernel's network testing driver can make the whole system crash when certain network and security tools are used together.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in netdevsim driver allows concurrent list_add_tail in nsim_bpf_create_prog and list_del in nsim_bpf_destroy_prog on bpf_bound_progs without synchronization, corrupting the list and triggering kernel BUG at lib/list_debug.c followed by panic.

Why it matters to the business

Systems using netdevsim for kernel or BPF development can experience sudden kernel crashes leading to downtime, lost work, and potential data corruption in affected environments.

How an attack unfolds

An attacker with local access loads the netdevsim module, rapidly creates and destroys BPF programs bound to netdevsim devices to trigger the unprotected concurrent list operations, resulting in list corruption and kernel panic during bpf_prog_free_deferred.

How to fix it

Upgrade the Linux kernel to the version containing commit 3f560cfc7706029294132482fff5d1bc7884b70d which adds a mutex to protect the bpf_bound_progs list.

How to confirm the fix worked

Verify the running kernel contains commit 3f560cfc7706029294132482fff5d1bc7884b70d; attempt to reproduce the race condition with netdevsim and BPF offload to confirm absence of crash.

Typical attack path

  1. Obtain local user access on the target system
  2. Load the netdevsim kernel module
  3. Repeatedly invoke nsim_bpf_create_prog and nsim_bpf_destroy_prog via BPF offload operations
  4. Trigger the unprotected concurrent list modification
  5. Cause list corruption and kernel crash

How to detect it

Inspect kernel crash dumps and dmesg for BUG reports at lib/list_debug.c involving nsim_bpf_destroy_prog or bpf_prog_free_deferred; correlate with netdevsim module usage in logs.

  • kernel BUG at lib/list_debug.c:62
  • nsim_bpf_destroy_prog+0x31/0x80 [netdevsim]
  • bpf_prog_free_deferred
  • __list_del_entry_valid_or_report

What your security team should do

  • Apply the kernel update containing the listed fix commit immediately on affected systems
  • Restrict use of netdevsim to isolated test environments only
  • Monitor kernel crash logs for list_debug.c and netdevsim entries

The record

In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_create_prog() performs list_add_tail, it is possible that nsim_bpf_destroy_prog() is simultaneously performs list_del. Concurrent operations on the list may lead to list corruption and trigger a kernel crash as follows: [ 417.290971] kernel BUG at lib/list_debug.c:62! [ 417.290983] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 417.290992] CPU: 10 PID: 168 Comm: kworker/10:1 Kdump: loaded Not tainted 6.19.0-rc5 #1 [ 417.291003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 417.291007] Workqueue: events bpf_prog_free_deferred [ 417.291021] RIP: 0010:__list_del_entry_valid_or_report+0xa7/0xc0 [ 417.291034] Code: a8 ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 48 a1 eb ae e8 ed fb a8 ff 0f 0b 48 89 fe 48 89 c2 48 c7 c7 80 a1 eb ae e8 d9 fb a8 ff <0f> 0b 48 89 d1 48 c7 c7 d0 a1 eb ae 48 89 f2 48 89 c6 e8 c2 fb a8 [ 417.291040] RSP: 0018:ffffb16a40807df8 EFLAGS: 00010246 [ 417.291046] RAX: 000000000000006d RBX: ffff8e589866f500 RCX: 0000000000000000 [ 417.291051] RDX: 0000000000000000 RSI: ffff8e59f7b23180 RDI: ffff8e59f7b23180 [ 417.291055] RBP: ffffb16a412c9000 R08: 0000000000000000 R09: 0000000000000003 [ 417.291059] R10: ffffb16a40807c80 R11: ffffffffaf9edce8 R12: ffff8e594427ac20 [ 417.291063] R13: ffff8e59f7b44780 R14: ffff8e58800b7a05 R15: 0000000000000000 [ 417.291074] FS: 0000000000000000(0000) GS:ffff8e59f7b00000(0000) knlGS:0000000000000000 [ 417.291079] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 417.291083] CR2: 00007fc4083efe08 CR3: 00000001c3626006 CR4: 0000000000770ee0 [ 417.291088] PKRU: 55555554 [ 417.291091] Call Trace: [ 417.291096] <TASK> [ 417.291103] nsim_bpf_destroy_prog+0x31/0x80 [netdevsim] [ 417.291154] __bpf_prog_offload_destroy+0x2a/0x80 [ 417.291163] bpf_prog_dev_bound_destroy+0x6f/0xb0 [ 417.291171] bpf_prog_free_deferred+0x18e/0x1a0 [ 417.291178] process_one_work+0x18a/0x3a0 [ 417.291188] worker_thread+0x27b/0x3a0 [ 417.291197] ? __pfx_worker_thread+0x10/0x10 [ 417.291207] kthread+0xe5/0x120 [ 417.291214] ? __pfx_kthread+0x10/0x10 [ 417.291221] ret_from_fork+0x31/0x50 [ 417.291230] ? __pfx_kthread+0x10/0x10 [ 417.291236] ret_from_fork_asm+0x1a/0x30 [ 417.291246] </TASK> Add a mutex lock, to prevent simultaneous addition and deletion operations on the list.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.16.0 6.1.162

Related vulnerabilities