Lockless qdiscs Vulnerability in the Linux Kernel

CVE-2026-23340

What is CVE-2026-23340?

A vulnerability exists in the Linux kernel involving the handling of lockless qdiscs, which can lead to a use-after-free (UAF) condition during network operations. Specifically, when the number of transmission queues is reduced, the function netif_set_real_num_tx_queues() triggers a reset through qdisc_reset_all_tx_gt(), but due to the concurrent execution with qdisc_run, a race condition arises. This condition can expose the system to integrity issues, particularly evident under heavy traffic conditions where rapid changes to queue parameters occur. Users may observe KASAN warnings related to slab-use-after-free, highlighting potential exploitation scenarios.

References