Cloudanix VulnDB

CVE-2026-23313

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux network handling can cause the system to lose track of processor scheduling during traffic processing, leading to warnings or reduced stability.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability causes a preempt count leak in the kernel's softirq handling for network receive processing in the i40e driver by calling get_cpu() without a matching put_cpu() in a tracepoint assignment.

Why it matters to the business

This can lead to kernel warnings and potential instability in network processing on affected Linux systems, increasing operational overhead for monitoring and maintenance.

How an attack unfolds

An attacker with local access triggers network receive activity on an i40e interface to invoke the faulty napi poll tracepoint, resulting in a preempt count mismatch that produces kernel warnings or scheduling anomalies.

How to fix it

Apply the upstream fix that replaces get_cpu() with smp_processor_id() in the i40e napi poll tracepoint; update to a patched Linux kernel version containing this change.

How to confirm the fix worked

Review the i40e driver source for the napi poll tracepoint to confirm use of smp_processor_id() and absence of get_cpu(); test network RX workloads and verify no softirq preempt count warnings appear in logs.

Typical attack path

  1. Obtain local access to a Linux system using the i40e driver
  2. Generate network RX traffic to enter the napi poll path
  3. Trigger the tracepoint assignment using get_cpu()
  4. Observe preempt count leak warnings or softirq anomalies

How to detect it

Search kernel logs and dmesg output for softirq entry/exit messages showing mismatched preempt counts during NET_RX processing on i40e interfaces.

  • softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?
  • preempt_count leak
  • i40e napi poll tracepoint

What your security team should do

  • Monitor kernel logs for softirq preempt count mismatch warnings
  • Prioritize kernel updates containing the tracepoint fix once released
  • Limit local access on systems using the i40e driver until patched

The record

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix preempt count leak in napi poll tracepoint Using get_cpu() in the tracepoint assignment causes an obvious preempt count leak because nothing invokes put_cpu() to undo it: softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101? This clearly has seen a lot of testing in the last 3+ years... Use smp_processor_id() instead.

Affected packages

Ecosystem Package Introduced Fixed