VulnerabilityPublished 4 Feb 2026Updated 19 Oct 2026

CVE-2026-23110: Linux kernel · Race Condition

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fe2f8ad6f0999db3b318359a01ee0108c703a8c3 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:18 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS

0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-06-10.

Patch

Available – fixed in fe2f8ad6f0999db3b318359a01ee0108c703a8c3, cc872e35c0df80062abc71268d690a2f749e542e, 219f009ebfd1ef3970888ee9eef4c8a06357f862 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6eb045e092efefafc6687409a6fa6d1dabf0fb69, < fe2f8ad6f0999db3b318359a01ee0108c703a8c3	Fixed in fe2f8ad6f0999db3b318359a01ee0108c703a8c3
LinuxLinux	Affected ≥ 6eb045e092efefafc6687409a6fa6d1dabf0fb69, < cc872e35c0df80062abc71268d690a2f749e542e	Fixed in cc872e35c0df80062abc71268d690a2f749e542e
LinuxLinux	Affected ≥ 6eb045e092efefafc6687409a6fa6d1dabf0fb69, < 219f009ebfd1ef3970888ee9eef4c8a06357f862	Fixed in 219f009ebfd1ef3970888ee9eef4c8a06357f862
LinuxLinux	Affected ≥ 6eb045e092efefafc6687409a6fa6d1dabf0fb69, < 64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0	Fixed in 64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0
LinuxLinux	Affected ≥ 6eb045e092efefafc6687409a6fa6d1dabf0fb69, < 9fdc6f28d5e81350ab1d2cac8389062bd09e61e1	Fixed in 9fdc6f28d5e81350ab1d2cac8389062bd09e61e1
LinuxLinux	Affected ≥ 6eb045e092efefafc6687409a6fa6d1dabf0fb69, < 6d9a367be356101963c249ebf10ea10b32886607	Fixed in 6d9a367be356101963c249ebf10ea10b32886607

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running command completes or times out has race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance. First, there is an memory ordering issue within scsi_dec_host_busy(). The write which clears SCMD_STATE_INFLIGHT may be reordered with reads counting in scsi_host_busy(). While the local CPU will see its own write, reordering can allow other CPUs in scsi_dec_host_busy() or scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to see a host busy equal to the host_failed count. This race condition can be prevented with a memory barrier on the error path to force the write to be visible before counting host busy commands. Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By counting busy commands before incrementing host_failed, it can race with a final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does not see host_failed incremented but scsi_eh_inc_host_failed() counts busy commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(), resulting in neither waking the error handler task. This needs the call to scsi_host_busy() to be moved after host_failed is incremented to close the race condition.

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
Leveraging Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

WeaknessesCWE-362

Technical details

References

Community reviews

Related threats