CVE-2026-23374: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23374 is a missing synchronization vulnerability in the Linux kernel's block layer tracing subsystem (blktrace) that can allow a low-privileged local user to trigger a denial of service. The flaw was disclosed on March 25, 2026, and affects Linux kernel versions from 3.8.1 up to (but not including) 6.12.82, versions 6.13 through 6.19.7, and Linux kernel 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-820 (Missing Synchronization). The __blk_add_trace() function calls tracing_record_cmdline(current) from process context where preemption is fully enabled, but tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save — operations that are only safe when preemption is disabled. The function trace_save_cmdline() explicitly asserts this via lockdep_assert_preemption_disabled(), as these per-CPU accessors were designed for scheduler context (e.g., probe_wakeup_sched_switch()). The same unsafe call pattern also exists in blk_add_trace_plug(), blk_add_trace_unplug(), and blk_add_trace_rq() paths. When triggered, the kernel lockdep mechanism fires a BUG: using __this_cpu_read() in preemptible [00000000] code warning (Red Hat Bugzilla).

Successful exploitation causes a denial of service: the kernel's lockdep assertion fires a BUG condition when __this_cpu_read() is called in a preemptible context, potentially halting blktrace operations or causing system instability. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The issue can be triggered by any local user with low privileges performing normal block I/O operations (e.g., using dd on a block device) while block layer tracing is active (Red Hat CVE, Red Hat Bugzilla).

1. Precondition: Obtain a local account with low privileges on a vulnerable Linux system (kernel 3.8.1–6.12.81, 6.13–6.19.6, or 7.0-rc1 through rc7).
2. Enable blktrace: Ensure block layer tracing is active on the target system, either by having it already enabled by an administrator or by enabling it via sysfs (requires appropriate permissions).
3. Trigger block I/O: Execute a block I/O operation on a block device while blktrace is active, for example: dd if=/dev/nullb1 of=/dev/null bs=4096 count=1.
4. Observe kernel BUG: The call path submit_bio → blk_add_trace_bio → __blk_add_trace → tracing_record_cmdline triggers __this_cpu_read() in a preemptible context, causing the kernel lockdep to fire a BUG condition visible in dmesg, resulting in denial of service (Red Hat Bugzilla).

• Logs (dmesg): Presence of BUG: using __this_cpu_read() in preemptible [00000000] code messages in kernel logs.
• Logs (dmesg): Stack trace entries referencing tracing_record_cmdline+0x10/0x40 and __blk_add_trace+0x307/0x5d0.
• Logs (dmesg): Kernel taint flags set (e.g., Tainted: G N) following the BUG condition.
• Process: Unusual or repeated dd, fio, or other block I/O tools running concurrently with active blktrace sessions on block devices (Red Hat Bugzilla).

Apply the upstream kernel patches available via the stable kernel tree (commits 59efa088752b, da46b5dfef48, e5584932ac1d). Fixed kernel versions include 6.12.82 and 6.19.7; users should upgrade to a patched kernel release. SUSE has issued security advisories (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1) with patched packages. As a temporary workaround, disabling blktrace functionality prevents the vulnerability from being triggered, though this limits tracing and debugging capabilities (Red Hat Bugzilla, SUSE Advisory).

SUSE issued multiple security update announcements addressing this CVE across their kernel packages. The Yocto Project security mailing list tracked the vulnerability across several messages. Tenable published Nessus detection plugins (303707, 318102, 318240, 319659) to identify affected systems. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (SUSE Advisory, Tenable).