CVE-2026-23463: soc: fsl: qbman: fix race condition in qman_destroy_fq
In the Linux kernel, the following vulnerability has been resolved:
soc: fsl: qbman: fix race condition in qmandestroyfq
When QMANFQFLAGDYNAMICFQID is set, there's a race condition between fqtable[fq->idx] state and freeing/allocating from the pool and WARNON(fqtable[fq->idx]) in qmancreatefq() gets triggered.
Indeed, we can have: Thread A Thread B qmandestroyfq() qmancreatefq() qmanreleasefqid() qmanshutdownfq() genpoolfree() -- At this point, the fqid is available again -- qmanallocfqid() -- so, we can get the just-freed fqid in thread B -- fq->fqid = fqid; fq->idx = fqid 2; WARNON(fqtable[fq->idx]); fqtable[fq->idx] = fq; fqtable[fq->idx] = NULL;
And adding some logs between qmanreleasefqid() and fqtable[fq->idx] = NULL makes the WARNON() trigger a lot more.
To prevent that, ensure that fqtable[fq->idx] is set to NULL before genpoolfree() is called by using smpwmb().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In qman_destroy_fq(), set fq_table[fq->idx] to NULL before calling gen_pool_free(), using smp_wmb() to ensure the ordering.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The race involves frame queues created with QMAN_FQ_FLAG_DYNAMIC_FQID and concurrent queue destruction and creation. A newly allocated FQID can be reused before its prior fq_table entry has been cleared.
Who can exploit this according to the CVSS assessment?
The CVSS vector indicates local access, low privileges, no user interaction, and high attack complexity. The reported impact is limited to availability.
How can an affected system be recognized?
A WARN_ON(fq_table[fq->idx]) in qman_create_fq() may trigger when the race occurs. The description notes that adding logging between qman_release_fqid() and clearing the fq_table entry makes this warning trigger frequently.