VulnerabilityPublished 3 Apr 2026Updated 10 Nov 2026

CVE-2026-23463: Linux kernel · soc: fsl: qbman: fix race condition in qman_destroy_fq

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d21923a8059fa896bfef016f55dd769299335cb4 : update Linux kernel when convenient.

Data as of 10 Nov 2026, 13:06 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Patch: Available – fixed in d21923a8059fa896bfef016f55dd769299335cb4, d288fbe652ef43b7128e4bc0c0c2ef6bd03a2210, 014077044e874e270ec480515edbc1cadb976cf2 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c535e923bb97a4b361e89a6383693482057f8b0c, < d21923a8059fa896bfef016f55dd769299335cb4	Fixed in d21923a8059fa896bfef016f55dd769299335cb4
LinuxLinux	Affected ≥ c535e923bb97a4b361e89a6383693482057f8b0c, < d288fbe652ef43b7128e4bc0c0c2ef6bd03a2210	Fixed in d288fbe652ef43b7128e4bc0c0c2ef6bd03a2210
LinuxLinux	Affected ≥ c535e923bb97a4b361e89a6383693482057f8b0c, < 014077044e874e270ec480515edbc1cadb976cf2	Fixed in 014077044e874e270ec480515edbc1cadb976cf2
LinuxLinux	Affected ≥ c535e923bb97a4b361e89a6383693482057f8b0c, < 66442cf9989bd4489fa80d9f37637d58ab016835	Fixed in 66442cf9989bd4489fa80d9f37637d58ab016835
LinuxLinux	Affected ≥ c535e923bb97a4b361e89a6383693482057f8b0c, < 751f60bd48edaf03f9d84ab09e5ce6705757d50f	Fixed in 751f60bd48edaf03f9d84ab09e5ce6705757d50f
LinuxLinux	Affected ≥ c535e923bb97a4b361e89a6383693482057f8b0c, < 265e56714635c5dd1e5964bfd97fa6e73f62cde5	Fixed in 265e56714635c5dd1e5964bfd97fa6e73f62cde5

AI-suggested

This vulnerability has been fixed in the Linux kernel. The fix involves setting fq_table[fq->idx] to NULL before freeing the fqid pool entry with appropriate memory barriers. Users should update to a Linux kernel version that includes the fix (commits listed in establishedFacts.fixedVersions). No additional mitigation is required beyond applying the official patch.

Description

A race condition vulnerability in the Linux kernel's soc: fsl: qbman component was fixed. The issue occurs in the qman_destroy_fq function when QMAN_FQ_FLAG_DYNAMIC_FQID is set, leading to a race between freeing and allocating fqid resources. This can trigger warnings and potentially unstable behavior due to improper synchronization of fq_table entries.

Impact

The vulnerability can cause race conditions leading to kernel warnings and potential instability in the fq_table management. While no direct exploitation or privilege escalation is documented, the race condition may affect kernel reliability and could contribute to denial of service or unpredictable kernel behavior.

Summary

CVE-2026-23463 addresses a race condition in the Linux kernel's soc: fsl: qbman subsystem within the qman_destroy_fq function. When the QMAN_FQ_FLAG_DYNAMIC_FQID flag is set, concurrent execution of qman_destroy_fq and qman_create_fq can cause a race between freeing an fqid and reallocating it, resulting in WARN_ON triggers due to fq_table state inconsistencies. The fix ensures that fq_table[fq->idx] is set to NULL before freeing the fqid pool entry by using a memory barrier (smp_wmb()), preventing the race condition.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Nov 2026, 13:06 UTC

Technical details

References

Community reviews

Related threats