Medium 4.7Published Apr 3, 2026

CVE-2026-23463soc: fsl: qbman: fix race condition in qman_destroy_fq

Updated under an hour ago (Oct 26, 2026, 2:10 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between fq_table[fq->idx] state and freeing/allocating from the pool and WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered. Indeed, we can have: Thread A Thread B qman_destroy_fq() qman_create_fq() qman_release_fqid() qman_shutdown_fq() gen_pool_free() -- At this point, the fqid is available again -- qman_alloc_fqid() -- so, we can get the just-freed fqid in thread B -- fq->fqid = fqid; fq->idx = fqid * 2; WARN_ON(fq_table[fq->idx]); fq_table[fq->idx] = fq; fq_table[fq->idx] = NULL; And adding some logs between qman_release_fqid() and fq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more. To prevent that, ensure that fq_table[fq->idx] is set to NULL before gen_pool_free() is called by using smp_wmb().

CVSS: 4.7 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c535e923bb97a4b361e89a6383693482057f8b0c before 66442cf9989bd4489fa80d9f37637d58ab016835; from c535e923bb97a4b361e89a6383693482057f8b0c before d288fbe652ef43b7128e4bc0c0c2ef6bd03a2210; from c535e923bb97a4b361e89a6383693482057f8b0c before 9e3d47904b8153c8c3ad2f9b66d5008aad677aa8; from c535e923bb97a4b361e89a6383693482057f8b0c before d21923a8059fa896bfef016f55dd769299335cb4; from c535e923bb97a4b361e89a6383693482057f8b0c before 751f60bd48edaf03f9d84ab09e5ce6705757d50f; from c535e923bb97a4b361e89a6383693482057f8b0c before 85dbbf7dc88b0a54f2e334daedf6f3f31fd004fa; from c535e923bb97a4b361e89a6383693482057f8b0c before 265e56714635c5dd1e5964bfd97fa6e73f62cde5; from c535e923bb97a4b361e89a6383693482057f8b0c before 014077044e874e270ec480515edbc1cadb976cf2	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.9 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/66442cf9989bd4489fa80d9f37637d58ab016835	patch
https://git.kernel.org/stable/c/d288fbe652ef43b7128e4bc0c0c2ef6bd03a2210	patch
https://git.kernel.org/stable/c/9e3d47904b8153c8c3ad2f9b66d5008aad677aa8	patch
https://git.kernel.org/stable/c/d21923a8059fa896bfef016f55dd769299335cb4	patch
https://git.kernel.org/stable/c/751f60bd48edaf03f9d84ab09e5ce6705757d50f	patch
https://git.kernel.org/stable/c/85dbbf7dc88b0a54f2e334daedf6f3f31fd004fa	patch
https://git.kernel.org/stable/c/265e56714635c5dd1e5964bfd97fa6e73f62cde5	patch
https://git.kernel.org/stable/c/014077044e874e270ec480515edbc1cadb976cf2	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.