CVE-2026-23473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23473", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "REJECTED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.022Z", "datePublished": "2026-04-03T15:15:51.928Z", "dateUpdated": "2026-05-02T06:17:49.349Z", "dateRejected": "2026-05-02T06:17:49.349Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-02T06:17:49.349Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "id": "CVE-2026-23473", "lastModified": "2026-10-16T14:10:00.120", "metrics": {}, "published": "2026-04-03T16:16:35.120", "references": [], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "kernel: io_uring/poll: fix multishot recv missing EOF on wakeup race", "id": "2454821", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454821"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's `io_uring/poll` subsystem. A race condition can occur when a socket performs send and shutdown operations in quick succession. This can cause a multishot receive operation to hang indefinitely, leading to a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-23473", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23473\nhttps://lore.kernel.org/linux-cve-announce/2026040323-CVE-2026-23473-ab6c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbc2564cfe0faff439dc46adb8c009589054ea46,0f4ce79b8db7b040373fc664c8bc6c5fd74bd196)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbc2564cfe0faff439dc46adb8c009589054ea46,bf33554b6abf7e7faeadd8af1b82037ea755a6bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbc2564cfe0faff439dc46adb8c009589054ea46,a68ed2df72131447d131531a08fe4dfcf4fa4653)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-07T10:36:39.503537+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the io_uring poll race condition fix.", "If an immediate kernel upgrade is not feasible, avoid calling shutdown() immediately after a send on sockets that use the multishot receive feature.", "Restart any processes that may be stuck in a hung receive loop after applying the patch."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All Linux kernel versions prior to the patch referenced in the commit series are affected. The only CNA vendor/product listed is Linux:Linux, and no specific version ranges are provided, so any kernel before the fix is potentially vulnerable. Users should verify their kernel version against the commit history for this fix.", "description_and_impact": "A race condition exists in the Linux kernel\u2019s io_uring poll implementation that can cause a multishot receive loop to hang indefinitely. The bug arises when a socket send is immediately followed by a shutdown, leading to the kernel losing a HUP event. As a result, the application may wait forever for an end\u2011of\u2011file that never arrives, causing a service stop or process freeze in the affected system.", "risk_and_exploitability": "The CVSS score of 5.5 indicates medium severity, and the EPSS score is below 1\u202f%, suggesting a low likelihood of exploitation in the wild. The CVE is not listed in the KEV catalog. Based on the description, the attack vector is inferred to be either local or remote control of socket traffic that triggers the vulnerable sequence; exploitation would require the ability to send data over a socket that uses the multishot receive loop and then perform a shutdown to induce a hang."}}}}, "created": "2026-04-03T21:13:26.008007+00:00", "updated": "2026-04-08T19:53:37.406199+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}