CVE-2026-23393
Published: 25 March 2026
Summary
CVE-2026-23393 is a high-severity Race Condition (CWE-362) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-23393 by requiring timely application of the kernel patch that replaces cancel_delayed_work_sync() with disable_delayed_work_sync() to eliminate the race condition and use-after-free.
Enables vulnerability scanning to identify systems running vulnerable Linux kernel versions affected by the bridge CFM race condition in CVE-2026-23393.
Provides defense-in-depth against exploitation of the use-after-free in CVE-2026-23393 via kernel memory protections like KASLR and stack canaries that hinder arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel use-after-free race condition directly enables privilege escalation via exploitation of the CFM peer MEP deletion path for arbitrary code execution.
NVD Description
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock…
more
(without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from br_cfm_frame_rx() are silently rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() because it is also used for the CC enable/disable toggle path where the work must remain re-schedulable.
Deeper analysisAI
CVE-2026-23393 is a race condition vulnerability in the Linux kernel's bridge Connectivity Fault Management (CFM) component, specifically during peer MEP deletion. The issue arises when cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing the peer_mep structure, but br_cfm_frame_rx()—running in softirq context under rcu_read_lock without RTNL—can reschedule the work via ccm_rx_timer_start() between the cancel returning and kfree_rcu() execution. This leads to ccm_rx_work_expired() accessing the already-freed peer_mep, resulting in a use-after-free. The vulnerability is scored at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-362 (race condition).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Exploitation involves triggering the race during peer MEP deletion, potentially allowing arbitrary code execution, data corruption, or denial of service through the use-after-free on the freed peer_mep structure in ccm_rx_work_expired().
The provided kernel patch references detail the mitigation: commits replace cancel_delayed_work_sync() with disable_delayed_work_sync() in both peer MEP deletion paths, ensuring subsequent queue_delayed_work() calls from br_cfm_frame_rx() are rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() as it supports CC enable/disable toggling where rescheduling is needed. Security practitioners should apply these stable kernel patches to vulnerable versions.
Details
- CWE(s)