--- id: CVE-2026-23103 title: 'kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)' summary: >- A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrs_lock was incorrectly used instead of a per-port lock, and some code paths (ipvlan_open/ipvlan_close) failed to acquire the lock entirely. Fo… severity: medium cvss: 4.7 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-413 vendor: Red Hat product: Red Hat Enterprise Linux 9 affected: - enterprise_linux 10 - enterprise_linux 9 - enterprise_linux_baseos_v_8 - enterprise_linux_crb_v_8 - enterprise_linux_nfv_v_8 - enterprise_linux_rt_v_8 patched: - enterprise_linux_baseos_v_8 - enterprise_linux_crb_v_8 - enterprise_linux_nfv_v_8 - enterprise_linux_rt_v_8 published: '2026-02-04' updated: '2026-09-17' sourceUpdated: '2026-09-17T12:41:10+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23103.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23103.json - url: 'https://access.redhat.com/security/cve/CVE-2026-23103' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2436771' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-23103' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23103' - url: >- https://lore.kernel.org/linux-cve-announce/2026020429-CVE-2026-23103-63b3@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:68531' - url: 'https://access.redhat.com/errata/RHSA-2026:68532' - url: 'https://git.kernel.org/stable/c/3c149b662cbb202a450e81f938e702ba333864ad' - url: 'https://git.kernel.org/stable/c/70feb16e3fbfb10b15de1396557c38e99f1ab8df' - url: 'https://git.kernel.org/stable/c/88f83e6c9cdb46b8c8ddd0ba01393362963cf589' - url: 'https://git.kernel.org/stable/c/04ba6de6eff61238e5397c14ac26a6578c7735a5' - url: 'https://git.kernel.org/stable/c/1f300c10d92c547c3a7d978e1212ff52f18256ed' - url: 'https://git.kernel.org/stable/c/6a81e2db096913d7e43aada1c350c1282e76db39' - url: 'https://git.kernel.org/stable/c/d3ba32162488283c0a4c5bedd8817aec91748802' tags: - csaf - vex - red-hat - cve.org - score-dispute epss: 0.00113 epssPercentile: 0.01315 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-06-16T20:21:03.730200Z' scores: vendor: 4.7 cna: 7.8 ingestedAt: '2026-09-08T15:33:26.993Z' --- ## Overview A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrs_lock was incorrectly used instead of a per-port lock, and some code paths (ipvlan_open/ipvlan_close) failed to acquire the lock entirely. For IPv6 address changes that don't require RTNL lock, concurrent address additions could cause false-negative results from ipvlan_addr_busy() or race conditions when adding addresses to the hash table. ## Vendor advisories - **RHSA-2026:68531** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68531) - **RHSA-2026:68532** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68532) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23103.json) **kernel: ipvlan: Make the addrs_lock be per port** — rated Moderate by Red Hat. Released 2026-02-04, updated 2026-09-17. Affected: - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 9 Fixed: - Red Hat Enterprise Linux BaseOS (v. 8) - Red Hat Enterprise Linux CRB (v. 8) - Red Hat Enterprise Linux NFV (v. 8) - Red Hat Enterprise Linux RT (v. 8) No fix planned: - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 9 Not affected: - Red Hat Enterprise Linux 6 - Red Hat Enterprise Linux 7 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:68531 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:68532 Workarounds / mitigations: - To mitigate this issue, prevent the ipvlan module from being loaded if IP-based virtual LAN networking is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.