CVE-2026-23168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23168", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.981Z", "datePublished": "2026-02-14T16:01:31.465Z", "dateUpdated": "2026-05-11T22:01:38.422Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:01:38.422Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nflex_proportions: make fprop_new_period() hardirq safe\n\nBernd has reported a lockdep splat from flexible proportions code that is\nessentially complaining about the following race:\n\n<timer fires>\nrun_timer_softirq - we are in softirq context\n call_timer_fn\n writeout_period\n fprop_new_period\n write_seqcount_begin(&p->sequence);\n\n <hardirq is raised>\n ...\n blk_mq_end_request()\n\t blk_update_request()\n\t ext4_end_bio()\n\t folio_end_writeback()\n\t\t__wb_writeout_add()\n\t\t __fprop_add_percpu_max()\n\t\t if (unlikely(max_frac < FPROP_FRAC_BASE)) {\n\t\t fprop_fraction_percpu()\n\t\t\tseq = read_seqcount_begin(&p->sequence);\n\t\t\t - sees odd sequence so loops indefinitely\n\nNote that a deadlock like this is only possible if the bdi has configured\nmaximum fraction of writeout throughput which is very rare in general but\nfrequent for example for FUSE bdis. To fix this problem we have to make\nsure write section of the sequence counter is irqsafe."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/flex_proportions.c"], "versions": [{"version": "a91befde350375b1ff954635acdde14dc92cd9a8", "lessThan": "0acc9ba7a1b5ba4d998c5753e709be904e179b75", "status": "affected", "versionType": "git"}, {"version": "a91befde350375b1ff954635acdde14dc92cd9a8", "lessThan": "884b2590ffcc7222cbbd6298051f4c243cc36f5d", "status": "affected", "versionType": "git"}, {"version": "a91befde350375b1ff954635acdde14dc92cd9a8", "lessThan": "78ede9ebd679dadf480dce6f7b798e3603f88348", "status": "affected", "versionType": "git"}, {"version": "a91befde350375b1ff954635acdde14dc92cd9a8", "lessThan": "b91a84299d72ae0e05551e851e47cd3008bd025b", "status": "affected", "versionType": "git"}, {"version": "a91befde350375b1ff954635acdde14dc92cd9a8", "lessThan": "dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/flex_proportions.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.162", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.123", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.69", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.9", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.162"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.123"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.69"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0acc9ba7a1b5ba4d998c5753e709be904e179b75"}, {"url": "https://git.kernel.org/stable/c/884b2590ffcc7222cbbd6298051f4c243cc36f5d"}, {"url": "https://git.kernel.org/stable/c/78ede9ebd679dadf480dce6f7b798e3603f88348"}, {"url": "https://git.kernel.org/stable/c/b91a84299d72ae0e05551e851e47cd3008bd025b"}, {"url": "https://git.kernel.org/stable/c/dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc"}], "title": "flex_proportions: make fprop_new_period() hardirq safe", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["lib/flex_proportions.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0acc9ba7a1b5ba4d998c5753e709be904e179b75", "status": "affected", "version": "a91befde350375b1ff954635acdde14dc92cd9a8", "versionType": "git"}, {"lessThan": "884b2590ffcc7222cbbd6298051f4c243cc36f5d", "status": "affected", "version": "a91befde350375b1ff954635acdde14dc92cd9a8", "versionType": "git"}, {"lessThan": "78ede9ebd679dadf480dce6f7b798e3603f88348", "status": "affected", "version": "a91befde350375b1ff954635acdde14dc92cd9a8", "versionType": "git"}, {"lessThan": "b91a84299d72ae0e05551e851e47cd3008bd025b", "status": "affected", "version": "a91befde350375b1ff954635acdde14dc92cd9a8", "versionType": "git"}, {"lessThan": "dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc", "status": "affected", "version": "a91befde350375b1ff954635acdde14dc92cd9a8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["lib/flex_proportions.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.162", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.123", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.69", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "83DE4E0F-B87E-49B8-B0C7-D01CE9B22054", "versionEndExcluding": "6.1.162", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "316D8D4E-FE44-4C76-8403-63CAF51EEFC2", "versionEndExcluding": "6.6.123", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F0D11B0-A3DA-4D8F-89B9-CFD2094EBA37", "versionEndExcluding": "6.12.69", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "171CFCB2-8F49-4F9E-8A67-FAC6BF45B5A2", "versionEndExcluding": "6.18.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nflex_proportions: make fprop_new_period() hardirq safe\n\nBernd has reported a lockdep splat from flexible proportions code that is\nessentially complaining about the following race:\n\n<timer fires>\nrun_timer_softirq - we are in softirq context\n call_timer_fn\n writeout_period\n fprop_new_period\n write_seqcount_begin(&p->sequence);\n\n <hardirq is raised>\n ...\n blk_mq_end_request()\n\t blk_update_request()\n\t ext4_end_bio()\n\t folio_end_writeback()\n\t\t__wb_writeout_add()\n\t\t __fprop_add_percpu_max()\n\t\t if (unlikely(max_frac < FPROP_FRAC_BASE)) {\n\t\t fprop_fraction_percpu()\n\t\t\tseq = read_seqcount_begin(&p->sequence);\n\t\t\t - sees odd sequence so loops indefinitely\n\nNote that a deadlock like this is only possible if the bdi has configured\nmaximum fraction of writeout throughput which is very rare in general but\nfrequent for example for FUSE bdis. To fix this problem we have to make\nsure write section of the sequence counter is irqsafe."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nflex_proportions: hacer que fprop_new_period() sea seguro para hardirq\n\nBernd ha reportado un lockdep splat del c\u00f3digo de proporciones flexibles que esencialmente se queja de la siguiente condici\u00f3n de carrera:\n\n\nrun_timer_softirq - estamos en contexto de softirq\n call_timer_fn\n writeout_period\n fprop_new_period\n write_seqcount_begin(&amp;p-&gt;sequence);\n\n \n ...\n blk_mq_end_request()\n\t blk_update_request()\n\t ext4_end_bio()\n\t folio_end_writeback()\n\t\t__wb_writeout_add()\n\t\t __fprop_add_percpu_max()\n\t\t if (unlikely(max_frac &lt; FPROP_FRAC_BASE)) {\n\t\t fprop_fraction_percpu()\n\t\t\tseq = read_seqcount_begin(&amp;p-&gt;sequence);\n\t\t\t - ve una secuencia impar por lo que entra en un bucle indefinido\n\nTenga en cuenta que un interbloqueo como este solo es posible si el bdi ha configurado una fracci\u00f3n m\u00e1xima de rendimiento de escritura, lo cual es muy raro en general pero frecuente, por ejemplo, para bdis FUSE. Para solucionar este problema, tenemos que asegurarnos de que la secci\u00f3n de escritura del contador de secuencia sea irqsafe."}], "id": "CVE-2026-23168", "lastModified": "2026-06-17T10:21:01.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-14T16:15:57.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0acc9ba7a1b5ba4d998c5753e709be904e179b75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/78ede9ebd679dadf480dce6f7b798e3603f88348"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/884b2590ffcc7222cbbd6298051f4c243cc36f5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b91a84299d72ae0e05551e851e47cd3008bd025b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: flex_proportions: make fprop_new_period() hardirq safe", "id": "2439941", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439941"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nflex_proportions: make fprop_new_period() hardirq safe\nBernd has reported a lockdep splat from flexible proportions code that is\nessentially complaining about the following race:\n<timer fires>\nrun_timer_softirq - we are in softirq context\ncall_timer_fn\nwriteout_period\nfprop_new_period\nwrite_seqcount_begin(&p->sequence);\n<hardirq is raised>\n...\nblk_mq_end_request()\nblk_update_request()\next4_end_bio()\nfolio_end_writeback()\n__wb_writeout_add()\n__fprop_add_percpu_max()\nif (unlikely(max_frac < FPROP_FRAC_BASE)) {\nfprop_fraction_percpu()\nseq = read_seqcount_begin(&p->sequence);\n- sees odd sequence so loops indefinitely\nNote that a deadlock like this is only possible if the bdi has configured\nmaximum fraction of writeout throughput which is very rare in general but\nfrequent for example for FUSE bdis. To fix this problem we have to make\nsure write section of the sequence counter is irqsafe."], "name": "CVE-2026-23168", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23168\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23168\nhttps://lore.kernel.org/linux-cve-announce/2026021420-CVE-2026-23168-0630@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a91befde350375b1ff954635acdde14dc92cd9a8,0acc9ba7a1b5ba4d998c5753e709be904e179b75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a91befde350375b1ff954635acdde14dc92cd9a8,884b2590ffcc7222cbbd6298051f4c243cc36f5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a91befde350375b1ff954635acdde14dc92cd9a8,78ede9ebd679dadf480dce6f7b798e3603f88348)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a91befde350375b1ff954635acdde14dc92cd9a8,b91a84299d72ae0e05551e851e47cd3008bd025b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a91befde350375b1ff954635acdde14dc92cd9a8,dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.162,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.123,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.69,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.9,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-17T19:30:29.731006+00:00", "value": {"mitigation_remediation": ["Upgrade the system to a Linux kernel that includes the patch for flex_proportions (e.g., any kernel version newer than the 6.19 release candidates that contain the fix).", "If an immediate kernel upgrade is not possible, configure block devices to avoid a high maximum write\u2011out throughput fraction\u2014set the BDI write\u2011out fraction to its default or zero to eliminate the race condition path.", "On systems that use FUSE block devices, disable or reduce the BDI write\u2011out fraction, or avoid write\u2011heavy workloads until the kernel is updated."], "summary": {"action": "Apply Patch", "impact": "Denial of Service through a deadlock or infinite loop"}, "threat_synthesis": {"affected_systems": "The flaw affects the Linux kernel across all releases that use the flexible proportions mechanism. At a minimum, the 6.19 release candidates 1 through 7 are known to be impacted, and any kernel version that has not yet applied the patch will also be vulnerable when the BDI maximum fraction is configured in a non\u2011default way.", "description_and_impact": "In the Linux kernel, a race condition exists in the flexible proportions code: when fprop_new_period begins a sequence counter update while a hardirq is raised, the counter is not interrupt\u2011safe. The hardirq path can modify the counter, causing a read of an odd sequence and an indefinite loop in the writeout code. This deadlock stalls the write back\u2011out path, potentially leading to severe performance degradation or system unresponsiveness. The issue is most pronounced when a block device interface (BDI) has a non\u2011default maximum write\u2011out throughput fraction, as seen on FUSE devices.", "risk_and_exploitability": "The CVSS score is 5.5 indicating moderate severity, and the EPSS score is below 1%, suggesting a very low probability of widespread exploitation. The flaw is not present in CISA\u2019s KEV list. Exploitation would require an attacker to be able to trigger the specific race condition which in practice is likely confined to local or privileged users with the ability to modify BDI write\u2011out settings or generate the necessary workloads. The impact is a denial of service rather than confidentiality or integrity compromise."}}}}, "created": "2026-02-16T09:44:21.901331+00:00", "updated": "2026-04-17T19:45:25.878904+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-574"]}