CVE-2026-23255

In the Linux kernel, the following vulnerability has been resolved:

net: add proper RCU protection to /proc/net/ptype

Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch.

Real issue is that ptype_seq_next() and ptype_seq_show() violate RCU rules.

ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev to get device name without any barrier.

At the same time, concurrent writers can remove a packet_type structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period.

Define ptype_iter_state to carry a dev pointer along seq_net_private:

struct ptype_iter_state { struct seq_net_private p; struct net_device *dev; // added in this patch };

We need to record the device pointer in ptype_get_idx() and ptype_seq_next() so that ptype_seq_show() is safe against concurrent pt->dev changes.

We also need to add full RCU protection in ptype_seq_next(). (Missing READ_ONCE() when reading list.next values)

Many thanks to Dong Chenchen for providing a repro.

This is an RCU synchronization bug in /proc/net/ptype iteration, where ptype_seq_next() and ptype_seq_show() accessed shared state without proper RCU-safe reads. A local attacker or stress tool may trigger the race by reading /proc/net/ptype while packet type or device state changes concurrently, leading mainly to RCU stalls or denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.