---
id: CVE-2026-23255
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: add proper RCU protection to /proc/net/ptype

  Yin Fengwei reported an RCU stall in ptype_seq_show() and provided
  a patch.

  Real issue is that ptype_seq_next() and …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: add proper RCU protection to /proc/net/ptype

  Yin Fengwei reported an RCU stall in ptype_seq_show() and provided
  a patch.

  Real issue is that ptype_seq_next() and …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.12.1, < 6.6.136'
  - 'linux_kernel >= 6.7, < 6.12.80'
  - 'linux_kernel >= 6.13, < 6.18.10'
  - linux_kernel = 2.6.12
  - linux_kernel = 6.19
patched:
  - linux_kernel 6.18.10
published: '2026-03-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T09:17:46.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23255'
references:
  - url: 'https://git.kernel.org/stable/c/002a73470b56848e4c81efeaaedd471e92d66d8d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/589a530ae44d0c80f523fcfd1a15af8087f27d35'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dcefd3f0b9ed8288654c75254bdcee8e1085e861'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e974a10a52618f7f57a4bce173a0ed96acd4e5dc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f613e8b4afea0cd17c7168e8b00e25bc8d33175d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00114
epssPercentile: 0.01705
ingestedAt: '2026-09-08T09:30:07.899Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: add proper RCU protection to /proc/net/ptype

Yin Fengwei reported an RCU stall in ptype_seq_show() and provided
a patch.

Real issue is that ptype_seq_next() and ptype_seq_show() violate
RCU rules.

ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev
to get device name without any barrier.

At the same time, concurrent writers can remove a packet_type structure
(which is correctly freed after an RCU grace period) and clear pt->dev
without an RCU grace period.

Define ptype_iter_state to carry a dev pointer along seq_net_private:

struct ptype_iter_state {
	struct seq_net_private	p;
	struct net_device	*dev; // added in this patch
};

We need to record the device pointer in ptype_get_idx() and
ptype_seq_next() so that ptype_seq_show() is safe against
concurrent pt->dev changes.

We also need to add full RCU protection in ptype_seq_next().
(Missing READ_ONCE() when reading list.next values)

Many thanks to Dong Chenchen for providing a repro.

## Affected

- `linux_kernel >= 2.6.12.1, < 6.6.136`
- `linux_kernel >= 6.7, < 6.12.80`
- `linux_kernel >= 6.13, < 6.18.10`
- `linux_kernel = 2.6.12`
- `linux_kernel = 6.19`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.18.10`