CVE-2026-23463

In the Linux kernel's QMan driver for Freescale DPAA devices, a race condition exists between qman_destroy_fq() and qman_create_fq() when QMAN_FQ_FLAG_DYNAMIC_FQID is set. The issue arises because the frame queue ID (fqid) is released to a pool before the corresponding fq_table entry is cleared, allowing a concurrent qman_create_fq() to allocate the same fqid and overwrite the table entry while the destroy function still expects it to be valid.

An attacker with local access and the ability to trigger concurrent creation and destruction of frame queues (e.g., via specific device operations) could exploit this race. No authentication is required beyond normal user access to the QMan subsystem. The race window is narrow, but can be widened by adding delays, making the WARN_ON() in qman_create_fq() more likely to trigger.

If successful, an attacker could cause a kernel panic (due to the WARN_ON or subsequent use-after-free conditions) leading to a denial of service. In some scenarios, the race may also lead to memory corruption or other undefined behavior, impacting system stability and availability.

The vulnerability is fixed in stable kernel commits [1]. Users should apply the latest kernel updates to ensure the race condition is mitigated via proper memory barriers (smp_wmb()) that order the fq_table update before the pool release.