{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23393", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.011Z", "datePublished": "2026-03-25T10:33:17.407Z", "dateUpdated": "2026-08-05T12:21:24.386Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:24.386Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: cfm: Fix race condition in peer_mep deletion\n\nWhen a peer MEP is being deleted, cancel_delayed_work_sync() is called\non ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in\nsoftirq context under rcu_read_lock (without RTNL) and can re-schedule\nccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync()\nreturning and kfree_rcu() being called.\n\nThe following is a simple race scenario:\n\n cpu0 cpu1\n\nmep_delete_implementation()\n cancel_delayed_work_sync(ccm_rx_dwork);\n br_cfm_frame_rx()\n // peer_mep still in hlist\n if (peer_mep->ccm_defect)\n ccm_rx_timer_start()\n queue_delayed_work(ccm_rx_dwork)\n hlist_del_rcu(&peer_mep->head);\n kfree_rcu(peer_mep, rcu);\n ccm_rx_work_expired()\n // on freed peer_mep\n\nTo prevent this, cancel_delayed_work_sync() is replaced with\ndisable_delayed_work_sync() in both peer MEP deletion paths, so\nthat subsequent queue_delayed_work() calls from br_cfm_frame_rx()\nare silently rejected.\n\nThe cc_peer_disable() helper retains cancel_delayed_work_sync()\nbecause it is also used for the CC enable/disable toggle path where\nthe work must remain re-schedulable." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability requires local access to configure bridge CFM via netlink (RTM_SETLINK requiring CAP_NET_ADMIN) and send CFM frames on virtual bridge interfaces, all achievable from a local user namespace.\nAC:L - The attacker controls both sides of the race — they can simultaneously delete peer MEPs via netlink and send CFM frames on virtual bridge port interfaces, making the race reliably triggerable.\nPR:L - CAP_NET_ADMIN is required for bridge CFM configuration, but it is obtainable via user namespaces (unshare -Urn) since netlink_net_capable checks against the namespace's user_ns.\nUI:N - No user interaction is needed; the attacker can set up the bridge, configure CFM, and trigger the race entirely autonomously.\nS:U - This is a standard kernel use-after-free with no cross-boundary impact such as VM escape or IOMMU bypass.\nC:H - The use-after-free allows the attacker to read freed memory that may be reallocated with controlled data, enabling arbitrary kernel memory disclosure.\nI:H - The use-after-free on the peer_mep structure enables heap spraying and potential arbitrary write primitives through control of the freed object's contents.\nA:H - The use-after-free causes ccm_rx_work_expired to operate on freed memory, reliably causing a kernel crash or panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bridge/br_cfm.c" ], "versions": [ { "version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525", "lessThan": "e89dbd2736a45f0507949af4748cbbf3ff793146", "status": "affected", "versionType": "git" }, { "version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525", "lessThan": "d8f35767bacb3c7769d470a41cf161e3f3c07e70", "status": "affected", "versionType": "git" }, { "version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525", "lessThan": "1fd81151f65927fd9edb8ecd12ad45527dbbe5ab", "status": "affected", "versionType": "git" }, { "version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525", "lessThan": "3715a00855316066cdda69d43648336367422127", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bridge/br_cfm.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.20" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.19.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e89dbd2736a45f0507949af4748cbbf3ff793146" }, { "url": "https://git.kernel.org/stable/c/d8f35767bacb3c7769d470a41cf161e3f3c07e70" }, { "url": "https://git.kernel.org/stable/c/1fd81151f65927fd9edb8ecd12ad45527dbbe5ab" }, { "url": "https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127" } ], "title": "bridge: cfm: Fix race condition in peer_mep deletion", "x_generator": { "engine": "bippy-1.2.0" } } } }