Look up another CVE · open CVE-2026-23393 in the interactive tracker
CVE-2026-23393
bridge: cfm: Fix race condition in peer_mep deletion
Published 2026-03-25 (7 months ago) by the Linux kernel CNA. Subsystem net/bridge. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-23393 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6238-1 · 2026-04-30 · text | 6.12.85-1 | Update the kernel and reboot. DSA-6238-1 shipped the fix on 2026-04-30, in 6.12.85-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.19.10-1 | Update the kernel and reboot. Fixed in 6.19.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.19.10-1 | Update the kernel and reboot. Fixed in 6.19.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from br_cfm_frame_rx() are silently rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() because it is also used for the CC enable/disable toggle path where the work must remain re-schedulable.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/bridge/br_cfm.c
- What this is
- ETHERNET BRIDGEMAINTAINERS section matched on net/bridge/ · bridge@lists.linux.dev · Maintained
- Kernel module
- none to look for. The file would have gone into bridge, and Debian does not compile it into that module, so finding bridge in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_BRIDGE|CONFIG_BRIDGE_CFM' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_BRIDGE, CONFIG_BRIDGE_CFM
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-03-25 (7 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.10%, higher than 0.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/bridge
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.11 | 6.12.78 | e89dbd2736a4 |
| 5.11 | 6.18.20 | d8f35767bacb |
| 5.11 | 6.19.10 | 1fd81151f659 |
| 5.11 | 7.0 | 3715a0085531 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DSA-6238-1 | 2026-04-30 | trixie 6.12.85-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerability requires local access to configure bridge CFM via netlink (RTM_SETLINK requiring CAP_NET_ADMIN) and send CFM frames on virtual bridge interfaces, all achievable from a local user namespace.
- AC:LAttack complexity, low
- The attacker controls both sides of the race — they can simultaneously delete peer MEPs via netlink and send CFM frames on virtual bridge port interfaces, making the race reliably triggerable.
- PR:LPrivileges required, low
- CAP_NET_ADMIN is required for bridge CFM configuration, but it is obtainable via user namespaces (unshare -Urn) since netlink_net_capable checks against the namespace's user_ns.
- UI:NUser interaction, none
- No user interaction is needed; the attacker can set up the bridge, configure CFM, and trigger the race entirely autonomously.
- S:UScope, unchanged
- This is a standard kernel use-after-free with no cross-boundary impact such as VM escape or IOMMU bypass.
- C:HConfidentiality impact, high
- The use-after-free allows the attacker to read freed memory that may be reallocated with controlled data, enabling arbitrary kernel memory disclosure.
- I:HIntegrity impact, high
- The use-after-free on the peer_mep structure enables heap spraying and potential arbitrary write primitives through control of the freed object's contents.
- A:HAvailability impact, high
- The use-after-free causes ccm_rx_work_expired to operate on freed memory, reliably causing a kernel crash or panic.