Medium 5.5Published Mar 18, 2026

CVE-2026-23255net: add proper RCU protection to /proc/net/ptype

Updated under an hour ago (Oct 26, 2026, 9:23 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: add proper RCU protection to /proc/net/ptype Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch. Real issue is that ptype_seq_next() and ptype_seq_show() violate RCU rules. ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev to get device name without any barrier. At the same time, concurrent writers can remove a packet_type structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period. Define ptype_iter_state to carry a dev pointer along seq_net_private: struct ptype_iter_state { struct seq_net_private p; struct net_device *dev; // added in this patch }; We need to record the device pointer in ptype_get_idx() and ptype_seq_next() so that ptype_seq_show() is safe against concurrent pt->dev changes. We also need to add full RCU protection in ptype_seq_next(). (Missing READ_ONCE() when reading list.next values) Many thanks to Dong Chenchen for providing a repro.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e974a10a52618f7f57a4bce173a0ed96acd4e5dc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 002a73470b56848e4c81efeaaedd471e92d66d8d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before dcefd3f0b9ed8288654c75254bdcee8e1085e861; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 589a530ae44d0c80f523fcfd1a15af8087f27d35; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f613e8b4afea0cd17c7168e8b00e25bc8d33175d	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 6.6.136; from 6.7 before 6.12.80; from 6.13 before 6.18.10; 2.6.12; 2.6.12; 2.6.12; 2.6.12; 2.6.12; and 8 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e974a10a52618f7f57a4bce173a0ed96acd4e5dc
https://git.kernel.org/stable/c/002a73470b56848e4c81efeaaedd471e92d66d8d	patch
https://git.kernel.org/stable/c/dcefd3f0b9ed8288654c75254bdcee8e1085e861	patch
https://git.kernel.org/stable/c/589a530ae44d0c80f523fcfd1a15af8087f27d35	patch
https://git.kernel.org/stable/c/f613e8b4afea0cd17c7168e8b00e25bc8d33175d	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.