CVE-2026-23294: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23294 is a race condition vulnerability in the Linux kernel's BPF devmap subsystem affecting PREEMPT_RT kernels. The flaw exists in the per-CPU xdp_dev_bulk_queue handling, where local_bh_disable() fails to prevent preemption on PREEMPT_RT, allowing concurrent access to shared queue structures. Affected kernel versions include 6.18.0–6.18.16, 6.19.0–6.19.6, and 7.0-rc1. It was disclosed on March 25, 2026, with patches available by May 29, 2026. The CVSS v3.1 base score is 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a concurrent execution race condition (CWE-362 / CWE-364) in the BPF devmap subsystem. On PREEMPT_RT kernels, local_bh_disable() only calls migrate_disable() rather than disabling preemption, allowing the CFS scheduler to preempt a task mid-execution of bq_xmit_all(). This enables a second task on the same CPU to enter bq_enqueue() and operate on the same per-CPU xdp_dev_bulk_queue (bq) concurrently. Four distinct races result: (1) double-free/use-after-free on bq->q[] when bq_xmit_all() snapshots cnt = bq->count but is preempted before completing transmission; (2) corruption of bq->count and bq->q[] through concurrent modification; (3) unsafe teardown of dev_rx/xdp_prog references between bq_xmit_all() return and bq->dev_rx = NULL; and (4) double invocation of __list_del_clearprev() on the same flush_node, dereferencing a NULL prev pointer. The fix adds a local_lock_t to xdp_dev_bulk_queue, using local_lock_nested_bh() which is a no-overhead annotation on non-RT kernels but provides a per-CPU sleeping lock on PREEMPT_RT (Red Hat Bugzilla).

Successful exploitation can cause kernel memory corruption, use-after-free conditions, and system crashes (denial of service). A local attacker with privileges to trigger XDP/BPF operations (typically requiring CAP_SYS_ADMIN or equivalent) can corrupt kernel memory structures, potentially leading to privilege escalation or arbitrary kernel code execution in addition to system instability. The impact is confined to the local system (scope unchanged), but kernel-level compromise could enable full system takeover (Red Hat CVE, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires local access with elevated privileges (CAP_SYS_ADMIN or similar) and is only triggerable on PREEMPT_RT kernel configurations, significantly limiting the attack surface. The EPSS score is 0.017% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Red Hat CVE).

Apply the upstream kernel patches available for affected stable branches: Linux 6.18.x (fixed in 6.18.17), Linux 6.19.x (fixed in 6.19.7), and the 7.0-rc series. Patch commits are available at the kernel stable tree (kernel patches). As a workaround, restrict XDP/BPF operations to trusted users by limiting CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities, or avoid deploying PREEMPT_RT kernels in security-sensitive environments until patched. Amazon Linux 2023 users should apply ALAS2023-2026-1596 (Amazon Linux Advisory).

The upstream kernel security advisory was published via the linux-cve-announce mailing list. Red Hat tracked the issue via Bugzilla (Bug 2451181) and their CVE advisory page. No notable public researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (Red Hat Bugzilla, Red Hat CVE).