PT-2026-26115 · Linux · Linux
Published
2026-03-18
·
Updated
2026-03-18
·
CVE-2026-23255
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: add proper RCU protection to /proc/net/ptype
Yin Fengwei reported an RCU stall in ptype seq show() and provided
a patch.
Real issue is that ptype seq next() and ptype seq show() violate
RCU rules.
ptype seq show() runs under rcu read lock(), and reads pt->dev
to get device name without any barrier.
At the same time, concurrent writers can remove a packet type structure
(which is correctly freed after an RCU grace period) and clear pt->dev
without an RCU grace period.
Define ptype iter state to carry a dev pointer along seq net private:
struct ptype iter state {
struct seq net private p;
struct net device *dev; // added in this patch
};
We need to record the device pointer in ptype get idx() and
ptype seq next() so that ptype seq show() is safe against
concurrent pt->dev changes.
We also need to add full RCU protection in ptype seq next().
(Missing READ ONCE() when reading list.next values)
Many thanks to Dong Chenchen for providing a repro.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux