LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs

In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like: BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: <TASK> ... __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110 ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ... </TASK> Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0 sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0 udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0 pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840 virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0 ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an empty queue, avoiding needless re-scheduling.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a local Linux kernel networking bug. A privileged local user who can alter transmit queue settings under traffic may trigger use-after-free in queue scheduling, risking crash or possible privilege-impacting memory corruption. It matters most on systems exposing queue/channel tuning to admins, virtualization hosts, appliances, and industrial products that embed affected Linux kernels.

Executive priority

Treat as high-priority kernel maintenance where local users or managed services share Linux hosts. The risk is local privilege and availability impact, not a standalone remote breach. Patch through trusted OS or appliance channels after validating operational dependencies.

Technical view

The flaw is a race between qdisc_reset_all_tx_gt() and the lockless qdisc dequeue path when real TX queues are reduced. Reset used qdisc_lock(), while lockless dequeue is serialized with qdisc->seqlock. Concurrent reset can free skbs still being dequeued, causing use-after-free. Stable kernel commits serialize reset with the lockless path and clear stale non-empty state.

Likely exposure

Exposure is local, not remotely reachable by itself. Systems are more relevant if users, services, orchestration, or appliance management paths can change network queue/channel counts on affected Linux kernels, especially with virtio-net or lockless qdiscs.

Exploitation context

The CVE is not listed as KEV in the supplied bundle, and no cited source states active exploitation. The source describes reliable reproduction under heavy traffic and repeated queue changes, but that is diagnostic evidence, not proof of public exploitation.

Researcher notes

The source evidence is strong for root cause and fix direction, but incomplete for downstream product scope. The affected-version data in the bundle is coarse and duplicated, so validate exposure against vendor kernel backports and commit presence rather than numeric version strings alone.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Use distribution or appliance vendor advisories rather than raw version assumptions.
  • Review Siemens advisories if operating affected Siemens industrial products.
  • Restrict local privileges that can change NIC queue or channel settings.
  • Prioritize internet-facing virtualization hosts and shared Linux platforms for maintenance windows.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded products.
  • Check whether installed kernels include one of the referenced stable commits.
  • Identify systems using lockless qdiscs, virtio-net, or configurable TX queue counts.
  • Confirm who can change NIC channel or queue settings locally.
  • Monitor vendor advisories for affected downstream kernel builds and appliance firmware.
Prepared
Confidence
high
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23340 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
10Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-23340Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7, 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7, 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7, 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7, 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7, 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7, 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7unaffected
LinuxLinux4.16, 0, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.