PT-2026-27705 · Ethtool+2 · Ethtool+2
Published
2026-01-01
·
Updated
2026-04-20
·
CVE-2026-23340
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a flaw in the networking subsystem related to traffic queue management. Specifically, a race condition can occur between
qdisc reset all tx gt() and the dequeue path for lockless qdiscs. This happens when shrinking the number of transmit queues, where qdisc reset all tx gt() flushes qdiscs, potentially leading to a use-after-free condition if skbs are freed while still being dequeued. The issue can be reproduced with tools like iperf3 and ethtool under heavy traffic and frequent queue pair changes. The kernel reports indicate a potential for memory corruption, specifically a slab-use-after-free in the qdisc run function. The vulnerability is related to the interaction between qdisc reset() and qdisc run(), and involves the serialization of qdisc operations.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Ethtool
Iperf3