CVE-2026-23374: Linux Kernel Race Condition Vulnerability

CVE-2026-23374 Overview

A vulnerability has been identified in the Linux kernel's blktrace subsystem where per-CPU variable operations (__this_cpu_read() and __this_cpu_write()) are executed in a preemptible context, violating kernel safety requirements. The tracing_record_cmdline() function operates on the per-CPU variable trace_cmdline_save and explicitly requires preemption to be disabled via lockdep_assert_preemption_disabled(). However, __blk_add_trace() calls this function from process context where preemption is fully enabled, triggering kernel BUG warnings and potential system instability.

Critical Impact

This vulnerability can cause kernel BUG warnings and system instability when blktrace operations are performed in preemptible contexts, affecting block I/O tracing functionality and potentially disrupting system operations.

Affected Products

• Linux Kernel (blktrace subsystem)
• Linux Kernel versions with PREEMPT(full) configuration
• Systems utilizing blktrace for block I/O debugging and tracing

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23374 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23374

Vulnerability Analysis

The vulnerability exists in the Linux kernel's block layer tracing subsystem (blktrace). The root issue stems from improper use of per-CPU variable access macros in a preemptible execution context.

The tracing_record_cmdline() function internally uses __this_cpu_read() and __this_cpu_write() operations on the per-CPU variable trace_cmdline_save. These operations were designed to be called from scheduler context (such as probe_wakeup_sched_switch() and probe_wakeup()) where preemption is guaranteed to be disabled.

When __blk_add_trace() is invoked, it calls tracing_record_cmdline(current) early in the blk_tracer path, before ring buffer reservation. At this point, the code is executing from process context where preemption is fully enabled. This violates the safety requirements for per-CPU variable operations, which can lead to data corruption if the thread is preempted and migrated to another CPU between the read and write operations.

The issue manifests across multiple code paths including blk_add_trace_plug(), blk_add_trace_unplug(), and blk_add_trace_rq(), indicating a systemic problem with preemption handling in the blktrace subsystem.

Root Cause

The vulnerability is caused by a race condition in the blktrace subsystem. The __blk_add_trace() function calls tracing_record_cmdline() without first disabling preemption. Since __this_cpu_read() and __this_cpu_write() operations are not atomic with respect to preemption, a task could be preempted and migrated to a different CPU mid-operation, leading to incorrect per-CPU variable access and potential data corruption.

The kernel's lockdep_assert_preemption_disabled() check correctly identifies this violation at runtime, triggering the BUG message when the condition is detected.

Attack Vector

This vulnerability is primarily a reliability and stability issue rather than a direct security exploit vector. The attack surface is limited to local scenarios where:

The vulnerability is triggered through normal block I/O tracing operations when using blktrace utilities or the ftrace blk tracer. The kernel BUG warnings and potential race conditions can cause system instability, denial of service conditions, or unpredictable behavior during block I/O tracing operations. Systems running with PREEMPT(full) kernel configurations are particularly susceptible to triggering this condition.

Detection Methods for CVE-2026-23374

Indicators of Compromise

• Kernel log messages containing "BUG: using __this_cpu_read() in preemptible" with caller tracing_record_cmdline
• Stack traces showing __blk_add_trace in the call path during blktrace operations
• Tainted kernel status indicated by [N]=TEST or similar tainting flags after triggering the condition
• System instability or crashes when running blktrace or block I/O tracing utilities

Detection Strategies

• Monitor kernel logs (dmesg) for BUG warnings related to preemption violations in tracing functions
• Run blktests suite (specifically blktrace/002) to verify if the system is vulnerable
• Check for tracing_record_cmdline appearing in kernel stack traces with preemption-related warnings
• Audit systems using blktrace utilities for unexpected kernel warnings or crashes

Monitoring Recommendations

• Enable kernel log monitoring for preemption violation warnings containing "preemptible" and "tracing_record_cmdline"
• Monitor system stability during block I/O intensive operations with tracing enabled
• Track kernel version and patch status across infrastructure to identify unpatched systems
• Set up automated alerts for kernel BUG messages in production environments

How to Mitigate CVE-2026-23374

Immediate Actions Required

• Apply the kernel patches referenced in commits 59efa08 and da46b5d from the stable kernel tree
• Update to a patched Linux kernel version that includes the blktrace preemption fix
• Temporarily avoid using blktrace or ftrace blk tracer on affected systems if patching is not immediately possible
• Monitor affected systems for kernel BUG warnings and address any stability issues

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fixes are available through the following kernel git commits:

• Kernel Git Commit 59efa08
• Kernel Git Commit da46b5d

These patches ensure that preemption is properly disabled before calling tracing_record_cmdline() in the blktrace code paths, preventing the race condition from occurring.

Workarounds

• Disable blktrace and block I/O tracing functionality until patches can be applied
• If tracing is required, consider using kernel configurations without PREEMPT(full) as a temporary measure
• Monitor systems closely for kernel BUG messages and be prepared to restart services if instability occurs
• Prioritize patching systems that rely heavily on block I/O tracing for debugging or monitoring

# Check current kernel version
uname -r

# Check if blktrace module is loaded
lsmod | grep blk

# View recent kernel messages for preemption warnings
dmesg | grep -i "preemptible"

# Temporarily disable blktrace if loaded
echo 0 > /sys/kernel/debug/tracing/events/block/enable