Linux Kernel up to 6.18.9 net /proc/net/ptype ptype_seq_next/ptype_seq_show state issue

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.9 and classified as critical. Affected by this issue is the function ptype_seq_next/ptype_seq_show of the file /proc/net/ptype of the component net. Such manipulation leads to state issue. This vulnerability is uniquely identified as CVE-2026-23255. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.9 and classified as critical. Affected by this issue is the function ptype_seq_next/ptype_seq_show of the file /proc/net/ptype of the component net. The manipulation with an unknown input leads to a state issue vulnerability. Using CWE to declare the problem leads to CWE-371. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net: add proper RCU protection to /proc/net/ptype Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch. Real issue is that ptype_seq_next() and ptype_seq_show() violate RCU rules. ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev to get device name without any barrier. At the same time, concurrent writers can remove a packet_type structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period. Define ptype_iter_state to carry a dev pointer along seq_net_private: struct ptype_iter_state { struct seq_net_private p; struct net_device *dev; // added in this patch }; We need to record the device pointer in ptype_get_idx() and ptype_seq_next() so that ptype_seq_show() is safe against concurrent pt->dev changes. We also need to add full RCU protection in ptype_seq_next(). (Missing READ_ONCE() when reading list.next values) Many thanks to Dong Chenchen for providing a repro.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-23255 since 01/13/2026. The exploitation is known to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/09/2026).

The vulnerability scanner Nessus provides a plugin with the ID 319993 (EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-2209)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.10 eliminates this vulnerability. Applying the patch 589a530ae44d0c80f523fcfd1a15af8087f27d35/f613e8b4afea0cd17c7168e8b00e25bc8d33175d is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (319993) and CERT Bund (WID-SEC-2026-0790). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion