CVE-2026-23393
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Mar 25, 2026
CISA due date
—
The record
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from br_cfm_frame_rx() are silently rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() because it is also used for the CC enable/disable toggle path where the work must remain re-schedulable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-azure | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.27.1.160000.2.8 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.28.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.28.1 |
Related vulnerabilities
- CVE-2026-46317 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign… Also affects dtb-aarch64
- CVE-2026-46316 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its… Also affects dtb-aarch64
- CVE-2026-46181 In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix… Also affects dtb-aarch64
- CVE-2026-46176 In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error… Also affects dtb-aarch64
- CVE-2026-46159 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix… Also affects dtb-aarch64
- CVE-2026-46114 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject… Also affects dtb-aarch64
- CVE-2026-46090 In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer… Also affects dtb-aarch64
- CVE-2026-46094 In the Linux kernel, the following vulnerability has been resolved: ext4: fix bounds… Also affects dtb-aarch64