CVE-2026-23393: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23393 is a race condition vulnerability in the Linux kernel's bridge CFM (Connectivity Fault Management) subsystem, specifically in the peer MEP (Maintenance End Point) deletion path. The flaw allows a use-after-free condition to occur when a peer MEP is deleted on one CPU while br_cfm_frame_rx() concurrently re-schedules the ccm_rx_dwork delayed work queue on another CPU, resulting in the work callback executing on already-freed memory. Affected kernel versions include 5.11.1 through 6.12.77, 6.13 through 6.18.19, and 6.19.0 through 6.19.9. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362) combined with an expired pointer dereference (CWE-825) in the kernel's bridge CFM peer MEP deletion implementation. When mep_delete_implementation() calls cancel_delayed_work_sync() on ccm_rx_dwork, a concurrent br_cfm_frame_rx() running in softirq context under rcu_read_lock (without RTNL lock) can invoke ccm_rx_timer_start() → queue_delayed_work(ccm_rx_dwork) in the window between the cancellation returning and kfree_rcu(peer_mep, rcu) being called. This results in ccm_rx_work_expired() executing against the now-freed peer_mep structure. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() in both peer MEP deletion paths, causing subsequent queue_delayed_work() calls to be silently rejected (Red Hat Bugzilla, Kernel Patches). Researchers have described this as a new Linux kernel race condition bug class termed "out-of-cancel" (core-jmp.org).

Successful exploitation by a low-privileged local attacker can result in kernel memory corruption via use-after-free, potentially leading to a kernel panic (denial of service), system crash, or privilege escalation. All three security dimensions are affected: confidentiality, integrity, and availability are each rated High in the CVSS assessment. Systems using bridge CFM networking features are most directly at risk, and exploitation could allow an attacker to escalate from a low-privileged user to kernel-level access (Red Hat Advisory, Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been observed as of the time of this report. The vulnerability requires local access with low privileges and precise timing to trigger the race condition between two CPUs, which increases exploitation complexity in practice. The EPSS score is 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, Feedly).

Patches are available across multiple stable kernel branches: upgrade to Linux 6.12.78 or later (for the 5.11.1–6.12.x series), 6.18.20 or later (for 6.13–6.18.x), or 6.19.10 or later (for 6.19.x). Downstream distributions including Debian, SUSE, and openSUSE have released updated packages incorporating these fixes. As a temporary workaround where patching is not immediately possible, consider disabling CFM features on affected bridge interfaces. Monitor systems for unexpected kernel panics or memory corruption errors that may indicate exploitation attempts (Red Hat Bugzilla, Kernel Patches).

Security researchers identified this vulnerability as representative of a new Linux kernel race condition bug class, dubbed "out-of-cancel," where work items can be re-queued after cancellation but before memory deallocation (core-jmp.org, v4bel blog). The vulnerability was noted by the broader Linux security community via the linux-cve-announce mailing list and tracked by multiple downstream vendors including Red Hat, SUSE, Debian, and the Yocto Project. Detection signatures have been published by Tenable (Nessus) and Qualys, indicating active scanner coverage.