CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype
In the Linux kernel, the following vulnerability has been resolved:
net: add proper RCU protection to /proc/net/ptype
Yin Fengwei reported an RCU stall in ptypeseqshow() and provided a patch.
Real issue is that ptypeseqnext() and ptypeseqshow() violate RCU rules.
ptypeseqshow() runs under rcureadlock(), and reads pt->dev to get device name without any barrier.
At the same time, concurrent writers can remove a packettype structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period.
Define ptypeiterstate to carry a dev pointer along seqnetprivate:
struct ptypeiterstate { struct seqnetprivate p; struct netdevice dev; // added in this patch };
We need to record the device pointer in ptypegetidx() and ptypeseqnext() so that ptypeseqshow() is safe against concurrent pt->dev changes.
We also need to add full RCU protection in ptypeseqnext(). (Missing READONCE() when reading list.next values)
Many thanks to Dong Chenchen for providing a repro.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch net: add proper RCU protection to /proc/net/ptype - Configuration
Apply the patch that adds proper RCU protection to /proc/net/ptype, including full RCU protection in ptype_seq_next() so ptype_seq_show() can safely read pt->dev while running under rcu_read_lock().
Linux kernel /proc/net/ptype (ptype_seq_next / ptype_seq_show) RCU protection = Add full RCU protection in ptype_seq_next() and ensure ptype_seq_show() is safe under rcu_read_lock() - Configuration
Apply the change that defines ptype_iter_state to carry a device pointer along seq_net_private, record the device pointer in ptype_get_idx(), and use it so ptype_seq_show() can obtain the device name without barriers and without needing an RCU grace period.
Linux kernel /proc/net/ptype ptype_iter_state (seq_net_private) device pointer recording = ptype_iter_state includes a dev pointer (struct net_device *dev) along seq_net_private
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23255?
The severity of CVE-2026-23255 is rated as medium due to potential stability issues.
How do I fix CVE-2026-23255?
To fix CVE-2026-23255, ensure you update to the latest patched version of the Linux kernel.
What components are affected by CVE-2026-23255?
CVE-2026-23255 affects the Linux kernel specifically related to the /proc/net/ptype interface.
What type of vulnerability is CVE-2026-23255?
CVE-2026-23255 is characterized as an RCU stall vulnerability in the Linux kernel.
Who reported CVE-2026-23255?
CVE-2026-23255 was reported by Yin Fengwei.