PT-2026-27758 · Linux · Linux Kernel

Published

2026-01-01

·

Updated

2026-04-30

·

CVE-2026-23393

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description A race condition exists in the bridge component when deleting a peer MEP (Maintenance Engineering Protocol). Specifically, the issue occurs because cancel delayed work sync() was called on ccm rx dwork before freeing the memory, but br cfm frame rx() could reschedule ccm rx dwork between the cancellation and the memory being freed, leading to a use-after-free condition. The issue was addressed by replacing cancel delayed work sync() with disable delayed work sync() in the peer MEP deletion paths, which silently rejects subsequent attempts to reschedule the work. The cc peer disable() helper retains cancel delayed work sync() as it is used in a different context where rescheduling is necessary.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

Related Identifiers

CVE-2026-23393
ECHO-0610-83E0-00DE
OESA-2026-1862
OESA-2026-1863
OESA-2026-1864
OPENSUSE-SU-2026:20572-1
SUSE-SU-2026:2111-1
SUSE-SU-2026:21237-1
SUSE-SU-2026:21352-1
SUSE-SU-2026:21361-1
SUSE-SU-2026:2195-1
SUSE-SU-2026:2202-1
SUSE-SU-2026:2215-1
SUSE-SU-2026:2216-1
SUSE-SU-2026:2217-1

Affected Products

Linux Kernel