CVE-2026-23463

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> soc: fsl: qbman: fix race condition in qman_destroy_fq<br /> <br /> When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there&amp;#39;s a race condition between<br /> fq_table[fq-&gt;idx] state and freeing/allocating from the pool and<br /> WARN_ON(fq_table[fq-&gt;idx]) in qman_create_fq() gets triggered.<br /> <br /> Indeed, we can have:<br /> Thread A Thread B<br /> qman_destroy_fq() qman_create_fq()<br /> qman_release_fqid()<br /> qman_shutdown_fq()<br /> gen_pool_free()<br /> -- At this point, the fqid is available again --<br /> qman_alloc_fqid()<br /> -- so, we can get the just-freed fqid in thread B --<br /> fq-&gt;fqid = fqid;<br /> fq-&gt;idx = fqid * 2;<br /> WARN_ON(fq_table[fq-&gt;idx]);<br /> fq_table[fq-&gt;idx] = fq;<br /> fq_table[fq-&gt;idx] = NULL;<br /> <br /> And adding some logs between qman_release_fqid() and<br /> fq_table[fq-&gt;idx] = NULL makes the WARN_ON() trigger a lot more.<br /> <br /> To prevent that, ensure that fq_table[fq-&gt;idx] is set to NULL before<br /> gen_pool_free() is called by using smp_wmb().