CVE-2026-23168: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23168 is a race condition vulnerability in the Linux kernel's flexible proportions subsystem (flex_proportions) where the fprop_new_period() function fails to protect its sequence counter write section against hardware interrupts (hardirqs). This can cause a softirq timer context and a hardirq handler to concurrently access the same sequence counter, resulting in an indefinite loop and system hang. The vulnerability was published on February 14, 2026, and affects Linux kernel versions 6.0–6.1.161, 6.2–6.6.122, 6.7–6.12.68, 6.13–6.18.8, and release candidates up to 6.19-rc7. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a concurrency flaw (CWE-362: Race Condition) in fprop_new_period(), which calls write_seqcount_begin() to begin a sequence counter write section while running in softirq context. If a hardware interrupt fires during this window and the interrupt handler's call chain reaches __fprop_add_percpu_max() → fprop_fraction_percpu() → read_seqcount_begin(), the reader observes an odd (locked) sequence value and spins indefinitely, deadlocking the CPU. This condition is particularly likely on systems where a block device (bdi) has a configured maximum fraction of writeout throughput — a configuration common with FUSE block devices. The fix makes the sequence counter write section interrupt-safe by using hardirq-safe locking primitives (Feedly, kernel.org patch).

Successful exploitation results in a denial-of-service condition: the affected CPU enters an indefinite spin loop waiting for a sequence counter that will never become even, causing the system to hang or become unresponsive. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Systems running FUSE-backed block devices or other bdis with writeout fraction limits face a higher probability of triggering this condition (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Patches are available across multiple stable kernel branches. Administrators should upgrade to one of the following fixed versions:

• 6.1.x series: 6.1.162 or later
• 6.6.x series: 6.6.123 or later
• 6.12.x series: 6.12.69 or later
• 6.18.x series: 6.18.9 or later

Systems using FUSE block devices or other bdis with a configured maximum writeout fraction should be prioritized for patching, as they are at elevated risk of triggering the race condition. Vendor-specific kernel updates have been issued by SUSE (SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Oracle Linux (ELSA-2026-50160, ELSA-2026-50232), and Ubuntu (USN-8393-1) (Feedly, SUSE Advisory).

The vulnerability has received routine coverage from Linux distribution security teams, with patch advisories issued by SUSE, Oracle Linux, and Ubuntu. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution update announcements (Feedly).