CVE-2026-23302: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23302 is a data-race vulnerability in the Linux kernel's networking subsystem, specifically around the socket callback pointers sk->sk_data_ready and sk->sk_write_space in UDP, TCP, and AF_UNIX implementations. Layers such as skmsg modify these function pointers while other CPUs may read them concurrently without proper memory ordering annotations, leading to unsynchronized access. The vulnerability affects Linux kernel versions from 4.20 up to (but not including) the patched releases. It carries a CVSS v3.1 base score of 4.7 (Medium), reflecting a local, high-complexity attack requiring low privileges (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-362 (Race Condition using Shared Resource with Improper Synchronization) and CWE-366 (Race Condition within a Thread). The sk->sk_data_ready and sk->sk_write_space socket callback pointers are written by one CPU (e.g., via skmsg or other networking layers) while being read concurrently by other CPUs, without the use of READ_ONCE()/WRITE_ONCE() annotations to enforce proper memory ordering. This missing annotation allows the compiler and CPU to reorder or tear reads/writes, resulting in memory consistency violations. The fix adds the appropriate READ_ONCE()/WRITE_ONCE() annotations across UDP, TCP, and AF_UNIX code paths (Red Hat Bugzilla, Kernel Patch).

Successful exploitation by a low-privileged local user can cause kernel memory consistency violations through concurrent socket operations on UDP, TCP, or AF_UNIX sockets, leading to kernel crashes or hangs. The primary impact is a denial of service — temporary or permanent disruption of system availability. There is no impact on confidentiality or data integrity, and lateral movement is not a direct consequence of this vulnerability (Red Hat Advisory).

Update the Linux kernel to one of the following patched versions based on your branch: 6.6.136 or later (for the 4.20–6.6 branch), 6.12.82 or later (for the 6.7–6.12 branch), 6.18.17 or later (for the 6.13–6.18 branch), or 6.19.7 or later (for the 6.19 branch). As a temporary workaround, avoid running untrusted code with local user privileges on vulnerable kernel versions. Patches are available from the upstream kernel repository and from Red Hat (Red Hat Advisory, Kernel Patch).