CVE-2026-23302: linux Race Condition
CVSS: 4.7v3.1MediumModified
AliasesUBUNTU-CVE-2026-23302DEBIAN-CVE-2026-23302
Published 25-03-2026Last modified 15-10-2026
Vulnerability summary
CVE-2026-23302 is a medium (CVSS 4.7) Race Condition vulnerability in linux. EPSS estimates a 0.09% chance of exploitation in the next 30 days, higher than 0.4% of scored vulnerabilities.
CVSS score
4.7/10
010
Medium · v3.1 (NVD)EPSS score
0.09%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 14 · Related 14Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk->sk_{data_ready,write_space} skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently. Add corresponding READ_ONCE()/WRITE_ONCE() annotations for UDP, TCP and AF_UNIX.
CVSS metrics
4 scores · 3 sources · 2 versionsLow 1.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesSingle source
Medium 4.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.09%
Chance of exploitation in the next 30 days
Percentile
0%
Versus all other CVEs
30-day change
0.00 pp
From 0.09% on 19-09-2026
19-09-202619-10-2026
EPSS score0.09%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu153 products
- linuxAll versions (No fix recorded) | < 6.8.0-136.136
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1061.64
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 604326b41a6fb9b4a78b6179335decee0365cd8c, < 279f2b67d1c44ee139bd3fdb221850daa9358449 | ≥ 604326b41a6fb9b4a78b6179335decee0365cd8c, < 7ad01905831c815520f1b0486336a03bb7420465 | ≥ 604326b41a6fb9b4a78b6179335decee0365cd8c, < c494448bb522bbbb63096540eb2319101a0480ab | ≥ 604326b41a6fb9b4a78b6179335decee0365cd8c, < f17c1c4acbe2bd702abce73a847a04a196fab2c5 | ≥ 604326b41a6fb9b4a78b6179335decee0365cd8c, < 27fccdbcbbfc4651b6f66756e6fa3f52e051ec23 | ≥ 604326b41a6fb9b4a78b6179335decee0365cd8c, < 2ef2b20cf4e04ac8a6ba68493f8780776ff84300 | 4.20
- linux_kernel≥ 4.20, < 6.6.136 | ≥ 6.7, < 6.12.82 | ≥ 6.13, < 6.18.17 | ≥ 6.19, < 6.19.7 | 7.0:rc1 | 7.0:rc2
Debian1 product
- linux< 6.1.177-1 | < 6.12.85-1 | < 6.19.8-1
3 vendors · 156 products
