Linux Kernel Vulnerability in BPF Accessing Race Conditions

CVE-2026-23294

What is CVE-2026-23294?

A race condition exists in the Linux kernel’s BPF when used in PREEMPT_RT configurations, where concurrent access from multiple preemptible tasks can lead to double-free errors and use-after-free vulnerabilities. This happens due to the incorrect assumption that certain functions run atomically, which is violated by the nature of task preemption in these configurations. The flaw impacts several areas, including potential corruption of internal data structures and the ability for tasks to improperly share data. The introduction of a locking mechanism will help serialize accesses to critical structures, addressing these vulnerabilities effectively.

References