CVE-2026-23342: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23342 is a race condition vulnerability in the Linux kernel's BPF cpumap subsystem affecting PREEMPT_RT kernels. The flaw allows concurrent access to the per-CPU xdp_bulk_queue (bq) structure by multiple preemptible tasks on the same CPU, leading to null pointer dereferences and memory corruption. Affected kernel versions include 6.18.1 through 6.18.16, 6.19 through 6.19.6, and 7.0 release candidates (rc1–rc7). It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper synchronization (CWE-362 / CWE-367) in the cpumap BPF subsystem. On PREEMPT_RT kernels, local_bh_disable() only calls migrate_disable() (when PREEMPT_RT_NEEDS_BH_LOCK is not set) rather than disabling preemption, breaking the atomicity assumption between bq_enqueue() and __cpu_map_flush(). This creates two distinct races: (1) a double __list_del_clearprev() where Task B's flush sets flush_node.prev to NULL before Task A resumes and dereferences it, causing a kernel oops; and (2) concurrent bq_enqueue() calls corrupting bq->count and bq->q[] while bq_flush_to_queue() is processing the queue. The fix introduces a local_lock_t in xdp_bulk_queue, acquired via local_lock_nested_bh() — a no-overhead annotation on non-RT systems and a per-CPU sleeping lock on PREEMPT_RT (Red Hat Bugzilla).

Successful exploitation results in kernel oops or panic due to null pointer dereference (when flush_node.prev is dereferenced after being set to NULL) and memory corruption of the XDP packet queue. The availability impact is high, as kernel panics cause complete system outages — particularly severe in real-time and safety-critical systems running PREEMPT_RT where stability is mandatory. There is no confidentiality or integrity impact beyond the kernel crash itself, and the vulnerability is locally scoped with no lateral movement potential (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit or active in-the-wild exploitation has been reported as of the time of writing. The vulnerability requires local access with low privileges and high attack complexity, limiting its practical exploitability. The EPSS score is 0.017% (0.000170), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 311340 (Red Hat Advisory).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing __list_del_clearprev, null pointer dereference in bq_flush_to_queue, or BPF cpumap-related stack traces.
• Process/Kernel Behavior: Unexpected system reboots or kernel panics on hosts running PREEMPT_RT kernels with active XDP/BPF cpumap workloads.
• System: Crash dumps (/var/crash/ or kdump output) containing stack frames involving bq_enqueue, __cpu_map_flush, or bq_flush_to_queue on PREEMPT_RT-enabled kernels.

Upgrade to Linux kernel version 6.18.17 or later, 6.19.7 or later, or the 7.0 final release. Patches are available in upstream kernel repositories via three commits on git.kernel.org (git.kernel.org patch 1, git.kernel.org patch 2, git.kernel.org patch 3). As a temporary workaround for systems that cannot be patched immediately, restrict or disable BPF cpumap operations and XDP processing on PREEMPT_RT systems. Amazon Linux 2023 users should apply ALAS2023-2026-1596. Prioritize patching on real-time and safety-critical deployments where kernel panics are unacceptable (Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (Bug 2451241) and published a CVE advisory. The upstream kernel security announcement was made via the linux-cve-announce mailing list by Greg Kroah-Hartman. No significant broader media coverage or notable researcher commentary beyond standard kernel security channels has been observed for this vulnerability (Red Hat Bugzilla).