LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23463: soc: fsl: qbman: fix race condition in qman_destroy_fq

In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between fq_table[fq->idx] state and freeing/allocating from the pool and WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered. Indeed, we can have: Thread A Thread B qman_destroy_fq() qman_create_fq() qman_release_fqid() qman_shutdown_fq() gen_pool_free() -- At this point, the fqid is available again -- qman_alloc_fqid() -- so, we can get the just-freed fqid in thread B -- fq->fqid = fqid; fq->idx = fqid * 2; WARN_ON(fq_table[fq->idx]); fq_table[fq->idx] = fq; fq_table[fq->idx] = NULL; And adding some logs between qman_release_fqid() and fq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more. To prevent that, ensure that fq_table[fq->idx] is set to NULL before gen_pool_free() is called by using smp_wmb().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

A timing flaw in the Linux Freescale QMan driver can let one thread reuse a queue identifier before another finishes removing its old table entry. This may trigger a kernel warning and leave queue-management state inconsistent. The sources do not establish broader security impact, remote reachability, or practical exploitation.

Executive priority

Use targeted, routine remediation rather than an emergency response unless affected QMan-based systems are operationally critical or showing warnings. Promptly confirm exposure because severity and security impact remain unscored and incompletely characterized.

Technical view

In qman_destroy_fq(), a dynamically allocated FQID could return to the pool before its fq_table entry was cleared. Concurrent qman_create_fq() activity could reallocate that FQID, encounter the stale entry, and trigger WARN_ON(). The referenced kernel fix clears the table entry before pool release and uses memory-ordering protection.

Likely exposure

Exposure is limited to Linux systems using the Freescale/NXP QBMan QMan code path with dynamically allocated FQIDs. The supplied affected-version data spans multiple kernel lines but is ambiguous; determine exposure using distribution or appliance advisories and the referenced stable commits.

Exploitation context

The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public exploit code, remote attackability, required privileges, or demonstrated impact beyond the race and kernel warning. Treat exploitability as unconfirmed.

Researcher notes

The documented failure is a destroy/create race involving fq_table state and FQID pool reuse. The correction changes operation ordering and adds smp_wmb(). Sources do not identify a CWE, CVSS vector, attacker-controlled trigger, memory corruption, privilege escalation, or denial-of-service outcome; those properties require further vendor-supported analysis.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable referenced stable fix.
  • Check appliance and Linux-distribution advisories for the exact corrected package version.
  • Prioritize systems that actively use Freescale/NXP QMan hardware and dynamic FQIDs.
  • Apply vendor-recommended operational mitigations if immediate kernel replacement is unavailable.

Validation and detection

  • Inventory kernels and appliances using the Freescale/NXP QBMan QMan driver.
  • Compare kernel sources or vendor changelogs against the referenced stable fixes.
  • Confirm the deployed kernel package includes the correction after maintenance.
  • Review kernel logs for related QMan warnings, without treating their absence as proof of safety.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23463 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc535e923bb97a4b361e89a6383693482057f8b0c, c535e923bb97a4b361e89a6383693482057f8b0c, c535e923bb97a4b361e89a6383693482057f8b0c, c535e923bb97a4b361e89a6383693482057f8b0c, c535e923bb97a4b361e89a6383693482057f8b0c, c535e923bb97a4b361e89a6383693482057f8b0c, c535e923bb97a4b361e89a6383693482057f8b0c, c535e923bb97a4b361e89a6383693482057f8b0cunaffected
LinuxLinux4.9, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.