---
id: CVE-2026-23001
title: 'macvlan: fix possible UAF in macvlan_forward_source()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  macvlan: fix possible UAF in macvlan_forward_source()

  Add RCU protection on (struct macvlan_source_entry)->vlan.

  Whenever macvlan_hash_del_source() is called, we must…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 <
    8133e85b8a3ec9f10d861e0002ec6037256e987e
  - >-
    Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 <
    484919832e2db6ce1e8add92c469e5d459a516b5
  - >-
    Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 <
    232afc74a6dde0fe1830988e5827921f5ec9bb3f
  - >-
    Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 <
    15f6faf36e162532bec5cc05eb3fc622108bf2ed
  - >-
    Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 <
    8518712a2ca952d6da2238c6f0a16b4ae5ea3f13
  - >-
    Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 <
    6dbead9c7677186f22b7981dd085a0feec1f038e
  - >-
    Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 <
    7470a7a63dc162f07c26dbf960e41ee1e248d80e
  - Linux 3.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-16T20:17:12.456069Z'
exploitAvailable: true
published: '2026-01-25'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:27.213Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23001'
references:
  - url: 'https://git.kernel.org/stable/c/8133e85b8a3ec9f10d861e0002ec6037256e987e'
  - url: 'https://git.kernel.org/stable/c/484919832e2db6ce1e8add92c469e5d459a516b5'
  - url: 'https://git.kernel.org/stable/c/232afc74a6dde0fe1830988e5827921f5ec9bb3f'
  - url: 'https://git.kernel.org/stable/c/15f6faf36e162532bec5cc05eb3fc622108bf2ed'
  - url: 'https://git.kernel.org/stable/c/8518712a2ca952d6da2238c6f0a16b4ae5ea3f13'
  - url: 'https://git.kernel.org/stable/c/6dbead9c7677186f22b7981dd085a0feec1f038e'
  - url: 'https://git.kernel.org/stable/c/7470a7a63dc162f07c26dbf960e41ee1e248d80e'
tags:
  - cve.org
  - exploit-available
epss: 0.00209
epssPercentile: 0.10422
exploits:
  github: 1
  githubRepos:
    - >-
      https://github.com/George0Papasotiriou/CVE-2026-23001-Hugging-Face-Transformers-Model-Deserialization-Arbitrary-Code-via-Pickle-
  checkedAt: '2026-10-19T18:36:25.052Z'
ingestedAt: '2026-10-19T18:35:50.111Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

macvlan: fix possible UAF in macvlan_forward_source()

Add RCU protection on (struct macvlan_source_entry)->vlan.

Whenever macvlan_hash_del_source() is called, we must clear
entry->vlan pointer before RCU grace period starts.

This allows macvlan_forward_source() to skip over
entries queued for freeing.

Note that macvlan_dev are already RCU protected, as they
are embedded in a standard netdev (netdev_priv(ndev)).

https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u

## Affected

- `Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 8133e85b8a3ec9f10d861e0002ec6037256e987e`
- `Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 484919832e2db6ce1e8add92c469e5d459a516b5`
- `Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 232afc74a6dde0fe1830988e5827921f5ec9bb3f`
- `Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 15f6faf36e162532bec5cc05eb3fc622108bf2ed`
- `Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 8518712a2ca952d6da2238c6f0a16b4ae5ea3f13`
- `Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 6dbead9c7677186f22b7981dd085a0feec1f038e`
- `Linux >= 79cf79abce71eb7dbc40e2f3121048ca5405cb47 < 7470a7a63dc162f07c26dbf960e41ee1e248d80e`
- `Linux 3.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.