PT-2026-30157 · Linux · Linux
Published
2026-04-03
·
Updated
2026-04-03
·
CVE-2026-23463
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
soc: fsl: qbman: fix race condition in qman destroy fq
When QMAN FQ FLAG DYNAMIC FQID is set, there's a race condition between
fq table[fq->idx] state and freeing/allocating from the pool and
WARN ON(fq table[fq->idx]) in qman create fq() gets triggered.
Indeed, we can have:
Thread A Thread B
qman destroy fq() qman create fq()
qman release fqid()
qman shutdown fq()
gen pool free()
-- At this point, the fqid is available again --
qman alloc fqid()
-- so, we can get the just-freed fqid in thread B --
fq->fqid = fqid;
fq->idx = fqid * 2;
WARN ON(fq table[fq->idx]);
fq table[fq->idx] = fq;
fq table[fq->idx] = NULL;
And adding some logs between qman release fqid() and
fq table[fq->idx] = NULL makes the WARN ON() trigger a lot more.
To prevent that, ensure that fq table[fq->idx] is set to NULL before
gen pool free() is called by using smp wmb().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux