PT-2026-30157 · Linux · Linux Kernel

Published 2026-04-03 · Updated 2026-04-20 · CVE-2026-23463

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a race condition within the qman destroy fq function in the soc: fsl: qbman component. This occurs when the QMAN FQ FLAG DYNAMIC FQID flag is set, specifically during the freeing and allocation of fqids. A race condition can occur between the fq table state and the pool allocation/deallocation, potentially triggering a WARN ON() error in qman create fq(). The issue arises when a freed fqid is reallocated to a different thread before the original thread completes its cleanup, leading to inconsistencies in the fq table.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-23463

ECHO-30D3-318A-FF38

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/d21923a8059fa896bfef016f55dd769299335cb4 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23463 · Vendor Advisory
• https://git.kernel.org/stable/c/d288fbe652ef43b7128e4bc0c0c2ef6bd03a2210 · Patch
• https://git.kernel.org/stable/c/9e3d47904b8153c8c3ad2f9b66d5008aad677aa8 · Patch
• https://git.kernel.org/stable/c/66442cf9989bd4489fa80d9f37637d58ab016835 · Patch
• https://cve.org/CVERecord?id=CVE-2026-23463 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-23463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23463 · Security Note
• https://git.kernel.org/stable/c/751f60bd48edaf03f9d84ab09e5ce6705757d50f · Patch
• https://git.kernel.org/stable/c/014077044e874e270ec480515edbc1cadb976cf2 · Patch
• https://git.kernel.org/stable/c/85dbbf7dc88b0a54f2e334daedf6f3f31fd004fa · Patch
• https://git.kernel.org/stable/c/265e56714635c5dd1e5964bfd97fa6e73f62cde5 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23463 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23463 · Vendor Advisory