Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23126— netdevsim: fix a race issue related to the operation on bpf_bound_progs list

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于netdevsim中对bpf_bound_progs列表操作缺乏保护，可能导致列表损坏和内核崩溃。

AI Predicted 5.5 Difficulty: Hard EPSS 0.10% · P1

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 31d3ad832948c75139b0e5b653912f7898a1d5d5< 3f560cfc7706029294132482fff5d1bc7884b70d affected
31d3ad832948c75139b0e5b653912f7898a1d5d5< f1f9cfd2f46a73b7de2982d01be822eac3a0efaa affected
31d3ad832948c75139b0e5b653912f7898a1d5d5< d77379ca82efcb2fe563359cc795027d680410db affected
31d3ad832948c75139b0e5b653912f7898a1d5d5< 68462ecc40ea8f780fb3c74ebfddd05506bb731b affected
31d3ad832948c75139b0e5b653912f7898a1d5d5< b97d5eedf4976cc94321243be83b39efe81a0e15 affected
4.16 affected
< 4.16 unaffected
6.1.162≤ 6.1.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23126

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_create_prog() performs list_add_tail, it is possible that nsim_bpf_destroy_prog() is simultaneously performs list_del. Concurrent operations on the list may lead to list corruption and trigger a kernel crash as follows: [ 417.290971] kernel BUG at lib/list_debug.c:62! [ 417.290983] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 417.290992] CPU: 10 PID: 168 Comm: kworker/10:1 Kdump: loaded Not tainted 6.19.0-rc5 #1 [ 417.291003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 417.291007] Workqueue: events bpf_prog_free_deferred [ 417.291021] RIP: 0010:__list_del_entry_valid_or_report+0xa7/0xc0 [ 417.291034] Code: a8 ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 48 a1 eb ae e8 ed fb a8 ff 0f 0b 48 89 fe 48 89 c2 48 c7 c7 80 a1 eb ae e8 d9 fb a8 ff <0f> 0b 48 89 d1 48 c7 c7 d0 a1 eb ae 48 89 f2 48 89 c6 e8 c2 fb a8 [ 417.291040] RSP: 0018:ffffb16a40807df8 EFLAGS: 00010246 [ 417.291046] RAX: 000000000000006d RBX: ffff8e589866f500 RCX: 0000000000000000 [ 417.291051] RDX: 0000000000000000 RSI: ffff8e59f7b23180 RDI: ffff8e59f7b23180 [ 417.291055] RBP: ffffb16a412c9000 R08: 0000000000000000 R09: 0000000000000003 [ 417.291059] R10: ffffb16a40807c80 R11: ffffffffaf9edce8 R12: ffff8e594427ac20 [ 417.291063] R13: ffff8e59f7b44780 R14: ffff8e58800b7a05 R15: 0000000000000000 [ 417.291074] FS: 0000000000000000(0000) GS:ffff8e59f7b00000(0000) knlGS:0000000000000000 [ 417.291079] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 417.291083] CR2: 00007fc4083efe08 CR3: 00000001c3626006 CR4: 0000000000770ee0 [ 417.291088] PKRU: 55555554 [ 417.291091] Call Trace: [ 417.291096] <TASK> [ 417.291103] nsim_bpf_destroy_prog+0x31/0x80 [netdevsim] [ 417.291154] __bpf_prog_offload_destroy+0x2a/0x80 [ 417.291163] bpf_prog_dev_bound_destroy+0x6f/0xb0 [ 417.291171] bpf_prog_free_deferred+0x18e/0x1a0 [ 417.291178] process_one_work+0x18a/0x3a0 [ 417.291188] worker_thread+0x27b/0x3a0 [ 417.291197] ? __pfx_worker_thread+0x10/0x10 [ 417.291207] kthread+0xe5/0x120 [ 417.291214] ? __pfx_kthread+0x10/0x10 [ 417.291221] ret_from_fork+0x31/0x50 [ 417.291230] ? __pfx_kthread+0x10/0x10 [ 417.291236] ret_from_fork_asm+0x1a/0x30 [ 417.291246] </TASK> Add a mutex lock, to prevent simultaneous addition and deletion operations on the list.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于netdevsim中对bpf_bound_progs列表操作缺乏保护，可能导致列表损坏和内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 31d3ad832948c75139b0e5b653912f7898a1d5d5 ~ 3f560cfc7706029294132482fff5d1bc7884b70d -
Linux Linux 4.16 -

II. Public POCs for CVE-2026-23126

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23126

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-02-14 · 108 CVEs total

CVE-2025-71202 8.8 HIGH iommu/sva: invalidate stale IOTLB entries for kernel address space
CVE-2026-23193 8.8 HIGH scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
CVE-2026-23172 8.4 HIGH net: wwan: t7xx: fix potential skb->frags overflow in RX path
CVE-2026-23191 7.8 HIGH ALSA: aloop: Fix racy access at PCM trigger
CVE-2025-71221 7.8 HIGH dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
CVE-2026-23178 7.8 HIGH HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
CVE-2026-23184 7.8 HIGH binder: fix UAF in binder_netlink_report()
CVE-2026-23185 7.8 HIGH wifi: iwlwifi: mld: cancel mlo_scan_start_wk
CVE-2026-23171 7.8 HIGH bonding: fix use-after-free due to enslave fail after slave array update
CVE-2026-23169 7.8 HIGH mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
CVE-2026-23192 7.8 HIGH linkwatch: use __dev_put() in callers to prevent UAF
CVE-2026-23209 7.8 HIGH macvlan: fix error recovery in macvlan_common_newlink()
CVE-2026-23198 7.8 HIGH KVM: Don't clobber irqfd routing type when deassigning irqfd
CVE-2026-23139 7.5 HIGH netfilter: nf_conncount: update last_gc only when GC has been performed
CVE-2026-23136 7.5 HIGH libceph: reset sparse-read state in osd_fault()
CVE-2026-23148 7.5 HIGH nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
CVE-2025-71204 7.5 HIGH smb/server: fix refcount leak in parse_durable_handle_context()
CVE-2026-23161 7.3 HIGH mm/shmem, swap: fix race of truncate and swap entry split
CVE-2025-71201 7.1 HIGH netfs: Fix early read unlock of page with EOF in middle
CVE-2026-23204 7.1 HIGH net/sched: cls_u32: use skb_header_pointer_careful()

Showing top 20 of 108 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23126

No comments yet

Leave a comment