{"id":"CVE-2026-23340","summary":"net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc-\u003eseqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n  iperf3 -ub0 -c $peer -t 0 &\n  while :; do\n    ethtool -L eth0 combined 1\n    ethtool -L eth0 combined 2\n  done\n\nWith KASAN enabled, this leads to reports like:\n\n  BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   ...\n   __qdisc_run+0x133f/0x1760\n   __dev_queue_xmit+0x248f/0x3550\n   ip_finish_output2+0xa42/0x2110\n   ip_output+0x1a7/0x410\n   ip_send_skb+0x2e6/0x480\n   udp_send_skb+0xb0a/0x1590\n   udp_sendmsg+0x13c9/0x1fc0\n   ...\n   \u003c/TASK\u003e\n\n  Allocated by task 1270 on cpu 5 at 44.558414s:\n   ...\n   alloc_skb_with_frags+0x84/0x7c0\n   sock_alloc_send_pskb+0x69a/0x830\n   __ip_append_data+0x1b86/0x48c0\n   ip_make_skb+0x1e8/0x2b0\n   udp_sendmsg+0x13a6/0x1fc0\n   ...\n\n  Freed by task 1306 on cpu 3 at 44.558445s:\n   ...\n   kmem_cache_free+0x117/0x5e0\n   pfifo_fast_reset+0x14d/0x580\n   qdisc_reset+0x9e/0x5f0\n   netif_set_real_num_tx_queues+0x303/0x840\n   virtnet_set_channels+0x1bf/0x260 [virtio_net]\n   ethnl_set_channels+0x684/0xae0\n   ethnl_default_set_doit+0x31a/0x890\n   ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc-\u003eseqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling.","modified":"2026-04-02T13:12:21.969372Z","published":"2026-03-25T10:27:28.728Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23340.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5bc4e69306ed7ae02232eb4c0b23ed621a26d504"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7594467c49bfc2f4644dee0415ac2290db11fa0d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7f083faf59d14c04e01ec05a7507f036c965acf8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c69df4e0524f8de8e176ba389acd83e85f5f49d0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23340.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23340"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7"},{"fixed":"7594467c49bfc2f4644dee0415ac2290db11fa0d"},{"fixed":"dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750"},{"fixed":"5bc4e69306ed7ae02232eb4c0b23ed621a26d504"},{"fixed":"8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb"},{"fixed":"c69df4e0524f8de8e176ba389acd83e85f5f49d0"},{"fixed":"7f083faf59d14c04e01ec05a7507f036c965acf8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23340.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.0"},{"fixed":"6.1.167"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.130"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.77"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.17"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23340.json"}}],"schema_version":"1.7.5"}