CVE-2026-23340

A flaw was found in the Linux kernel. A race condition exists in the network queue management (qdisc) component when the number of transmit queues is dynamically reduced while network traffic is active. This can lead to a Use-After-Free (UAF) vulnerability, where memory is prematurely freed while still being accessed. A local attacker could exploit this to cause a denial of service.

This flaw affects systems where network queue counts are dynamically changed (e.g., via ethtool -L) while traffic is flowing. The race between qdisc_reset_all_tx_gt() and __qdisc_run() for lockless qdiscs causes SKBs to be freed while being dequeued. Easily reproducible on virtio-net with concurrent queue resizing and traffic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.