CVE-2026-23001High· 7.8▾ MidnightPoC availableIn the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
1 GitHub repo (last check)
In the Linux kernel, the following vulnerability has been resolved:
macvlan: fix possible UAF in macvlan_forward_source()
Add RCU protection on (struct macvlan_source_entry)->vlan.
Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts.
This allows macvlan_forward_source() to skip over entries queued for freeing.
Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)).
https: //lore.kernel.org/netdev/695fb1e8.[email protected]/T/#u
Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 8133e85b8a3ec9f10d861e0002ec6037256e987eLinux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 484919832e2db6ce1e8add92c469e5d459a516b5Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 232afc74a6dde0fe1830988e5827921f5ec9bb3fLinux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 15f6faf36e162532bec5cc05eb3fc622108bf2edLinux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 8518712a2ca952d6da2238c6f0a16b4ae5ea3f13Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 6dbead9c7677186f22b7981dd085a0feec1f038eLinux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 7470a7a63dc162f07c26dbf960e41ee1e248d80eLinux 3.18Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-68121High· 7.8pppoe: reload header pointer after dev_hard_header()
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers