Linux CVE-2026-23463

The vulnerability exists in the Linux kernel's Freescale QBMan (Queue Based Memory Access Node) driver, specifically in the queue frame descriptor (FQ) lifecycle management. QBMan is a hardware queue manager used in NXP processors for packet switching and data plane operations. The flaw involves a classic time-of-check-time-of-use (TOCTOU) race condition in the soc/fsl/qbman subsystem when QMAN_FQ_FLAG_DYNAMIC_FQID is set, indicating dynamic FQID allocation from a generic pool. The fq_table array tracks active queue descriptors by index (fqid * 2), and the race occurs between Thread A clearing the table entry (fq_table[fq->idx] = NULL) and calling gen_pool_free() to return the FQID to the allocator pool. During this window, Thread B can allocate the same FQID, set fq_table[fq->idx] to itself, then Thread A overwrites it with NULL, leaving a dangling reference and triggering WARN_ON assertions in qman_create_fq(). The root cause is a missing write memory barrier (smp_wmb) between the table cleanup and pool deallocation, violating acquire-release semantics required for safe concurrent data structure updates.