In the Linux kernel, the following vulnerability has been resolved:
soc: fsl: qbman: fix race condition in qman_destroy_fq
When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between
fq_table[fq->idx] state and freeing/allocating from the pool and
WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered.
Indeed, we can have:
Thread A Thread B
qman_destroy_fq() qman_create_fq()
qman_release_fqid()
qman_shutdown_fq()
gen_pool_free()
-- At this point, the fqid is available again --
qman_alloc_fqid()
-- so, we can get the just-freed fqid in thread B --
fq->fqid = fqid;
fq->idx = fqid * 2;
WARN_ON(fq_table[fq->idx]);
fq_table[fq->idx] = fq;
fq_table[fq->idx] = NULL;
And adding some logs between qman_release_fqid() and
fq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more.
To prevent that, ensure that fq_table[fq->idx] is set to NULL before
gen_pool_free() is called by using smp_wmb().
References
Configurations
Configuration 1 (hide)
|
History
20 May 2026, 15:25
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/014077044e874e270ec480515edbc1cadb976cf2 - Patch | |
| References | () https://git.kernel.org/stable/c/265e56714635c5dd1e5964bfd97fa6e73f62cde5 - Patch | |
| References | () https://git.kernel.org/stable/c/66442cf9989bd4489fa80d9f37637d58ab016835 - Patch | |
| References | () https://git.kernel.org/stable/c/751f60bd48edaf03f9d84ab09e5ce6705757d50f - Patch | |
| References | () https://git.kernel.org/stable/c/85dbbf7dc88b0a54f2e334daedf6f3f31fd004fa - Patch | |
| References | () https://git.kernel.org/stable/c/9e3d47904b8153c8c3ad2f9b66d5008aad677aa8 - Patch | |
| References | () https://git.kernel.org/stable/c/d21923a8059fa896bfef016f55dd769299335cb4 - Patch | |
| References | () https://git.kernel.org/stable/c/d288fbe652ef43b7128e4bc0c0c2ef6bd03a2210 - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-362 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
18 Apr 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-03 16:16
Updated : 2026-05-20 15:25
NVD link : CVE-2026-23463
Mitre link : CVE-2026-23463
CVE.ORG link : CVE-2026-23463
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')