CVE-2026-23255 net: add proper RCU protection to /proc/net/ptype
A race condition in the Linux kernel's /proc/net/ptype handling can cause an RCU stall, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23255?
CVE-2026-23255 is a medium-severity vulnerability in Linux kernel, published on 18 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: add proper RCU protection to /proc/net/ptype
Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch.
Real issue is that ptype_seq_next() and ptype_seq_show() violate RCU rules.
ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev to get device name without any barrier.
At the same time, concurrent writers can remove a packet_type structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period.
Define ptype_iter_state to carry a dev pointer along seq_net_private:
struct ptype_iter_state { struct seq_net_private p; struct net_device *dev; // added in this patch };
We need to record the device pointer in ptype_get_idx() and ptype_seq_next() so that ptype_seq_show() is safe against concurrent pt->dev changes.
We also need to add full RCU protection in ptype_seq_next(). (Missing READ_ONCE() when reading list.next values)
Many thanks to Dong Chenchen for providing a repro.
Which versions are affected by CVE-2026-23255?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23255?
Apply the vendor's patch.
Is CVE-2026-23255 being exploited?
There is no known exploitation of CVE-2026-23255 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80076, BELL-CVE-2026-23255, DEBIAN-CVE-2026-23255, GHSA-9w39-mw48-92gc, ROOT-OS-DEBIAN-11-CVE-2026-23255, ROOT-OS-DEBIAN-12-CVE-2026-23255 and 4 more.