{"id":"CVE-2026-23103","title":"kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)","summary":"A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrs_lock was incorrectly used instead of a per-port lock, and some code paths (ipvlan_open/ipvlan_close) failed to acquire the lock entirely. Fo…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-413","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9","enterprise_linux_baseos_v_8","enterprise_linux_crb_v_8","enterprise_linux_nfv_v_8","enterprise_linux_rt_v_8"],"patched":["enterprise_linux_baseos_v_8","enterprise_linux_crb_v_8","enterprise_linux_nfv_v_8","enterprise_linux_rt_v_8"],"published":"2026-02-04","updated":"2026-09-17","sourceUpdated":"2026-09-17T12:41:10+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23103.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23103.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-23103"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436771"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23103"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23103"},{"url":"https://lore.kernel.org/linux-cve-announce/2026020429-CVE-2026-23103-63b3@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:68531"},{"url":"https://access.redhat.com/errata/RHSA-2026:68532"},{"url":"https://git.kernel.org/stable/c/3c149b662cbb202a450e81f938e702ba333864ad"},{"url":"https://git.kernel.org/stable/c/70feb16e3fbfb10b15de1396557c38e99f1ab8df"},{"url":"https://git.kernel.org/stable/c/88f83e6c9cdb46b8c8ddd0ba01393362963cf589"},{"url":"https://git.kernel.org/stable/c/04ba6de6eff61238e5397c14ac26a6578c7735a5"},{"url":"https://git.kernel.org/stable/c/1f300c10d92c547c3a7d978e1212ff52f18256ed"},{"url":"https://git.kernel.org/stable/c/6a81e2db096913d7e43aada1c350c1282e76db39"},{"url":"https://git.kernel.org/stable/c/d3ba32162488283c0a4c5bedd8817aec91748802"}],"tags":["csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00113,"epssPercentile":0.0131,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-16T20:21:03.730200Z"},"scores":{"vendor":4.7,"cna":7.8},"ingestedAt":"2026-09-08T15:33:26.993Z","slug":"CVE-2026-23103","body":"## Overview\n\nA race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrs_lock was incorrectly used instead of a per-port lock, and some code paths (ipvlan_open/ipvlan_close) failed to acquire the lock entirely. For IPv6 address changes that don't require RTNL lock, concurrent address additions could cause false-negative results from ipvlan_addr_busy() or race conditions when adding addresses to the hash table.\n\n## Vendor advisories\n\n- **RHSA-2026:68531** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68531)\n- **RHSA-2026:68532** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68532)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23103.json)\n\n**kernel: ipvlan: Make the addrs_lock be per port** — rated Moderate by Red Hat. Released 2026-02-04, updated 2026-09-17.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nFixed:\n\n- Red Hat Enterprise Linux BaseOS (v. 8)\n- Red Hat Enterprise Linux CRB (v. 8)\n- Red Hat Enterprise Linux NFV (v. 8)\n- Red Hat Enterprise Linux RT (v. 8)\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.\n\nBecause of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:68531\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.\n\nBecause of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:68532\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, prevent the ipvlan module from being loaded if IP-based virtual LAN networking is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":206316,"id":"CVE-2026-23103","ts":1789663206118,"field":"cvss","old":"7.8","new":"4.7"},{"seq":206315,"id":"CVE-2026-23103","ts":1789663206118,"field":"severity","old":"high","new":"medium"}]}