{"id":"CVE-2026-23001","state":"PUBLISHED","title":"macvlan: fix possible UAF in macvlan_forward_source()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix possible UAF in macvlan_forward_source()\n\nAdd RCU protection on (struct macvlan_source_entry)->vlan.\n\nWhenever macvlan_hash_del_source() is called, we must clear\nentry->vlan pointer before RCU grace period starts.\n\nThis allows macvlan_forward_source() to skip over\nentries queued for freeing.\n\nNote that macvlan_dev are already RCU protected, as they\nare embedded in a standard netdev (netdev_priv(ndev)).\n\nhttps: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u","publishedAt":"2026-01-25T14:36:15.790Z","updatedAt":"2026-10-19T18:25:27.213Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"8133e85b8a3ec9f10d861e0002ec6037256e987e","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"484919832e2db6ce1e8add92c469e5d459a516b5","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"232afc74a6dde0fe1830988e5827921f5ec9bb3f","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"15f6faf36e162532bec5cc05eb3fc622108bf2ed","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"8518712a2ca952d6da2238c6f0a16b4ae5ea3f13","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"6dbead9c7677186f22b7981dd085a0feec1f038e","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"7470a7a63dc162f07c26dbf960e41ee1e248d80e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/macvlan.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.18","versionType":"semver"},{"version":"5.10.249","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.199","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.162","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.122","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.67","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.7","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/macvlan.c"]}],"references":["https://git.kernel.org/stable/c/8133e85b8a3ec9f10d861e0002ec6037256e987e","https://git.kernel.org/stable/c/484919832e2db6ce1e8add92c469e5d459a516b5","https://git.kernel.org/stable/c/232afc74a6dde0fe1830988e5827921f5ec9bb3f","https://git.kernel.org/stable/c/15f6faf36e162532bec5cc05eb3fc622108bf2ed","https://git.kernel.org/stable/c/8518712a2ca952d6da2238c6f0a16b4ae5ea3f13","https://git.kernel.org/stable/c/6dbead9c7677186f22b7981dd085a0feec1f038e","https://git.kernel.org/stable/c/7470a7a63dc162f07c26dbf960e41ee1e248d80e"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23001.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23001","state":"PUBLISHED","datePublished":"2026-01-25T14:36:15.790Z","dateUpdated":"2026-10-19T18:25:27.213Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:45.938Z"},"containers":{"cna":{"title":"macvlan: fix possible UAF in macvlan_forward_source()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix possible UAF in macvlan_forward_source()\n\nAdd RCU protection on (struct macvlan_source_entry)->vlan.\n\nWhenever macvlan_hash_del_source() is called, we must clear\nentry->vlan pointer before RCU grace period starts.\n\nThis allows macvlan_forward_source() to skip over\nentries queued for freeing.\n\nNote that macvlan_dev are already RCU protected, as they\nare embedded in a standard netdev (netdev_priv(ndev)).\n\nhttps: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"8133e85b8a3ec9f10d861e0002ec6037256e987e","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"484919832e2db6ce1e8add92c469e5d459a516b5","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"232afc74a6dde0fe1830988e5827921f5ec9bb3f","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"15f6faf36e162532bec5cc05eb3fc622108bf2ed","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"8518712a2ca952d6da2238c6f0a16b4ae5ea3f13","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"6dbead9c7677186f22b7981dd085a0feec1f038e","versionType":"git"},{"version":"79cf79abce71eb7dbc40e2f3121048ca5405cb47","status":"affected","lessThan":"7470a7a63dc162f07c26dbf960e41ee1e248d80e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/macvlan.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.18","versionType":"semver"},{"version":"5.10.249","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.199","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.162","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.122","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.67","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.7","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/macvlan.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/8133e85b8a3ec9f10d861e0002ec6037256e987e"},{"url":"https://git.kernel.org/stable/c/484919832e2db6ce1e8add92c469e5d459a516b5"},{"url":"https://git.kernel.org/stable/c/232afc74a6dde0fe1830988e5827921f5ec9bb3f"},{"url":"https://git.kernel.org/stable/c/15f6faf36e162532bec5cc05eb3fc622108bf2ed"},{"url":"https://git.kernel.org/stable/c/8518712a2ca952d6da2238c6f0a16b4ae5ea3f13"},{"url":"https://git.kernel.org/stable/c/6dbead9c7677186f22b7981dd085a0feec1f038e"},{"url":"https://git.kernel.org/stable/c/7470a7a63dc162f07c26dbf960e41ee1e248d80e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The reliable attacker-controlled path requires local rtnetlink manipulation of macvlan source-mode entries or failed macvlan creation, followed by local packet injection through a lower device such as veth/tun. Received frames reach the buggy RX handler, but creating the vulnerable stale source entry is a local operation.\nAC:L - The attacker can create the macvlan/source-entry state and trigger packet delivery repeatedly; the demonstrated stale-entry case is deterministic, and source-entry deletion races are attacker-controllable with concurrent netlink and packet activity.\nPR:L - The setup path requires CAP_NET_ADMIN for RTM_NEWLINK/RTM_SETLINK/RTM_DELLINK, but this is reachable by an unprivileged local user in a user-created user/net namespace on systems allowing user namespaces. It does not require real init-namespace root.\nUI:N - No victim action is required once the local attacker runs the netlink operations and injects matching frames. Exploitation is driven entirely by attacker-controlled local processes.\nS:U - The vulnerability corrupts or dereferences memory within the same kernel security authority. It is a standard kernel memory-safety issue, not a VM escape or cross-scope boundary violation.\nC:H - This is a use-after-free involving a freed macvlan/net_device-private object, and reclaimed heap contents can be exposed or used as attacker-shaped kernel pointers. Per kernel CVSS guidance, UAFs are scored as high confidentiality impact.\nI:H - The freed object is later used as a live macvlan_dev and passed into forwarding/statistics paths, giving plausible control-flow or write-primitive opportunities after heap reclaim. Per kernel CVSS guidance, UAF memory corruption is high integrity impact.\nA:H - Syzbot observed a KASAN slab-use-after-free in macvlan_forward_source(), and the bug can crash or panic the kernel. A kernel UAF reachable on demand is high availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:20:04.510Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"5.10.249"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"5.15.199"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.1.162"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.6.122"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.12.67"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.18.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.19"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-23001","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-06-16T20:17:12.456069Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:25:27.213Z"}}]}}}