Skip to content
OpenAdvisories
High · 7.8 CVE-2026-23393 EUVD-2026-15394GHSA-27jv-r6jg-f5fr

bridge: cfm: Fix race condition in peer_mep deletion

Published Mar 25, 2026 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

bridge: cfm: Fix race condition in peer_mep deletion

When a peer MEP is being deleted, cancel_delayed_work_sync() is called
on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in
softirq context under rcu_read_lock (without RTNL) and can re-schedule
ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync()
returning and kfree_rcu() being called.

The following is a simple race scenario:

cpu0 cpu1

mep_delete_implementation()
cancel_delayed_work_sync(ccm_rx_dwork);
br_cfm_frame_rx()
// peer_mep still in hlist
if (peer_mep->ccm_defect)
ccm_rx_timer_start()
queue_delayed_work(ccm_rx_dwork)
hlist_del_rcu(&peer_mep->head);
kfree_rcu(peer_mep, rcu);
ccm_rx_work_expired()
// on freed peer_mep

To prevent this, cancel_delayed_work_sync() is replaced with
disable_delayed_work_sync() in both peer MEP deletion paths, so
that subsequent queue_delayed_work() calls from br_cfm_frame_rx()
are silently rejected.

The cc_peer_disable() helper retains cancel_delayed_work_sync()
because it is also used for the CC enable/disable toggle path where
the work must remain re-schedulable.

Affected products

VendorProductAffectedFixed
Linux Linux 5.11 6.12.78

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 linux 6.19.10-1 —
Debian 13 linux 6.12.85-1 —
Debian 12 linux No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield No fix yet —
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield No fix yet —
Ubuntu 25.10 linux +8 No fix yet —
Ubuntu 24.04 LTS linux +43 No fix yet —
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1035.38 USN-8781-1
Ubuntu 22.04 LTS linux +59 No fix yet —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime +3 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime +2 No fix yet —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux-aws-5.15 +10 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +7 6.4.0-150700.53.55.1 SUSE-SU-2026:2238-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.55.1.150700.17.33.1 SUSE-SU-2026:2238-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.112.1 SUSE-SU-2026:2195-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.112.1.150600.12.52.1 SUSE-SU-2026:2195-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_0 15-160000.4.3 SUSE-SU-2026:22872-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_1 13-160000.1.1 SUSE-SU-2026:22864-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_2 11-160000.1.1 SUSE-SU-2026:22876-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_3 10-160000.1.1 SUSE-SU-2026:22869-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_4 9-160000.1.1 SUSE-SU-2026:22867-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_5 8-160000.1.1 SUSE-SU-2026:22874-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_6 7-160000.1.1 SUSE-SU-2026:22873-1
SLES for SAP 15 SP6 kernel-default-base 6.4.0-150600.23.112.1.150600.12.52.1 SUSE-SU-2026:2195-1
SLES for SAP 15 SP6 kernel-docs +4 6.4.0-150600.23.112.1 SUSE-SU-2026:2195-1
SLES 16.0 kernel-livepatch-SLE16_Update_0 15-160000.4.3 SUSE-SU-2026:22872-1
SLES 16.0 kernel-livepatch-SLE16_Update_1 13-160000.1.1 SUSE-SU-2026:22864-1
SLES 16.0 kernel-livepatch-SLE16_Update_2 11-160000.1.1 SUSE-SU-2026:22876-1
SLES 16.0 kernel-livepatch-SLE16_Update_3 10-160000.1.1 SUSE-SU-2026:22869-1
SLES 16.0 kernel-livepatch-SLE16_Update_4 9-160000.1.1 SUSE-SU-2026:22867-1
SLES 16.0 kernel-livepatch-SLE16_Update_5 8-160000.1.1 SUSE-SU-2026:22874-1
SLES 16.0 kernel-livepatch-SLE16_Update_6 7-160000.1.1 SUSE-SU-2026:22873-1
SLE Micro 6.2 gdk-pixbuf 2.42.12-160000.4.1 SUSE-SU-2026:21230-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.27.1.160000.2.8 SUSE-SU-2026:21237-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_0 13-160000.3.4 SUSE-SU-2026:22785-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_1 12-160000.1.1 SUSE-SU-2026:22784-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_0 15-160000.4.3 SUSE-SU-2026:22755-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_1 13-160000.1.1 SUSE-SU-2026:22743-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_2 11-160000.1.1 SUSE-SU-2026:22761-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_3 +1 10-160000.1.1 SUSE-SU-2026:22783-1, SUSE-SU-2026:22748-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_4 +2 9-160000.1.1 SUSE-SU-2026:22786-1, SUSE-SU-2026:22782-1, SUSE-SU-2026:22746-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_5 +1 8-160000.1.1 SUSE-SU-2026:22778-1, SUSE-SU-2026:22759-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_6 +1 7-160000.1.1 SUSE-SU-2026:22777-1, SUSE-SU-2026:22758-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.28.1 SUSE-SU-2026:21237-1, SUSE-SU-2026:21230-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_10 18-1.1 SUSE-SU-2026:22914-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_13 +1 9-1.1 SUSE-SU-2026:22696-1, SUSE-SU-2026:22689-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_22 3-1.2 SUSE-SU-2026:22695-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_9 18-1.2 SUSE-SU-2026:22912-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_10 +1 14-1.1 SUSE-SU-2026:22915-1, SUSE-SU-2026:22673-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_11 +2 13-1.1 SUSE-SU-2026:22913-1, SUSE-SU-2026:22675-1, SUSE-SU-2026:22674-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_13 11-1.1 SUSE-SU-2026:22676-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_14 9-1.2 SUSE-SU-2026:22682-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_16 +1 8-1.1 SUSE-SU-2026:22690-1, SUSE-SU-2026:22677-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_17 +1 7-1.1 SUSE-SU-2026:22691-1, SUSE-SU-2026:22683-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_18 +1 6-1.1 SUSE-SU-2026:22692-1, SUSE-SU-2026:22684-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_19 +1 4-1.1 SUSE-SU-2026:22693-1, SUSE-SU-2026:22685-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_20 +4 3-1.1 SUSE-SU-2026:22697-1, SUSE-SU-2026:22694-1, SUSE-SU-2026:22687-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_8 +1 20-1.2 SUSE-SU-2026:22681-1, SUSE-SU-2026:22680-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_10 18-1.1 SUSE-SU-2026:22794-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_13 +1 9-1.1 SUSE-SU-2026:22725-1, SUSE-SU-2026:22711-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_22 3-1.2 SUSE-SU-2026:22717-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_9 18-1.2 SUSE-SU-2026:22792-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_10 +1 14-1.1 SUSE-SU-2026:22795-1, SUSE-SU-2026:22718-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_11 +2 13-1.1 SUSE-SU-2026:22793-1, SUSE-SU-2026:22720-1, SUSE-SU-2026:22719-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_13 11-1.1 SUSE-SU-2026:22721-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_14 9-1.2 SUSE-SU-2026:22730-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_16 +1 8-1.1 SUSE-SU-2026:22722-1, SUSE-SU-2026:22712-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_17 +1 7-1.1 SUSE-SU-2026:22731-1, SUSE-SU-2026:22713-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_18 +1 6-1.1 SUSE-SU-2026:22732-1, SUSE-SU-2026:22714-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_19 +1 4-1.1 SUSE-SU-2026:22733-1, SUSE-SU-2026:22715-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_20 +4 3-1.1 SUSE-SU-2026:22735-1, SUSE-SU-2026:22734-1, SUSE-SU-2026:22726-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_8 +1 20-1.2 SUSE-SU-2026:22729-1, SUSE-SU-2026:22728-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.55.1 SUSE-SU-2026:2238-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_11 6-150700.2.1 SUSE-SU-2026:2855-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_8 9-150700.2.1 SUSE-SU-2026:2857-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_9 8-150700.2.1 SUSE-SU-2026:2858-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_1 19-150700.2.2 SUSE-SU-2026:2930-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_10 +1 6-150700.2.2 SUSE-SU-2026:2956-1, SUSE-SU-2026:2945-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_12 5-150700.2.2 SUSE-SU-2026:2887-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_14 3-150700.2.2 SUSE-SU-2026:2943-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_15 1-150700.15.3.1 SUSE-SU-2026:2238-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_7 9-150700.2.2 SUSE-SU-2026:2902-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_9 8-150700.2.2 SUSE-SU-2026:2895-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.112.1 SUSE-SU-2026:2195-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_12 20-150600.2.2 SUSE-SU-2026:2894-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_13 18-150600.2.2 SUSE-SU-2026:2902-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_22 6-150600.2.2 SUSE-SU-2026:2866-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_23 5-150600.2.2 SUSE-SU-2026:2957-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_25 3-150600.2.2 SUSE-SU-2026:2945-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_26 1-150600.13.3.1 SUSE-SU-2026:2195-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_27 21-150500.2.2 SUSE-SU-2026:2899-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_28 20-150500.2.2 SUSE-SU-2026:2933-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_30 15-150500.2.2 SUSE-SU-2026:2868-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_31 13-150500.2.2 SUSE-SU-2026:2890-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_37 6-150500.2.2 SUSE-SU-2026:2938-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_39 4-150500.2.2 SUSE-SU-2026:2961-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_41 21-150400.2.1 SUSE-SU-2026:2867-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_43 17-150400.2.1 SUSE-SU-2026:2920-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_44 16-150400.2.1 SUSE-SU-2026:2889-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_45 14-150400.2.1 SUSE-SU-2026:2864-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_46 10-150400.2.1 SUSE-SU-2026:2910-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_49 6-150400.2.1 SUSE-SU-2026:2932-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_51 5-150400.2.1 SUSE-SU-2026:2937-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_52 4-150400.2.1 SUSE-SU-2026:2888-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.27.1.160000.2.8 openSUSE-SU-2026:20572-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.28.1 openSUSE-SU-2026:20572-1

Advisories 50

References