CVE-2026-23273
published 2026-03-20CVE-2026-23273: In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
valis reported that a race condition still happens after my prior patch.
macvlan_common_newlink() might have made @dev visible before
detecting an error, and its caller will directly call free_netdev(dev).
We must respect an RCU period, either in macvlan or the core networking
stack.
After adding a temporary mdelay(1000) in macvlan_forward_source_one()
to open the race window, valis repro was:
ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1
ip link set up dev p1
ip link set up dev p2
ip link add mv0 link p2 type macvlan mode source
(ip link add invalid% link p2 type macvlan mode source macaddr add
00:00:00:00:00:20 &) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4
PING 1.2.3.4 (1.2.3.4): 56 data bytes
RTNETLINK answers: Invalid argument
BUG: KASAN: slab-use-after-free in macvlan_forward_source
(drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
Read of size 8 at addr ffff888016bb89c0 by task e/175
CPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
Call Trace:
dump_stack_lvl (lib/dump_stack.c:123)
print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
kasan_report (mm/kasan/report.c:597)
? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
? tasklet_init (kernel/softirq.c:983)
macvlan_handle_frame (drivers/net/macvlan.c:501)
Allocated by task 169:
kasan_save_stack (mm/kasan/common.c:58)
kasan_save_track (./arch/x86/include/asm/current.h:25
mm/kasan/common.c:70 mm/kasan/common.c:79)
__kasan_kmalloc (mm/kasan/common.c:419)
__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657
mm/slub.c:7140)
alloc_netdev_m
Affected
71 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.14-1 (forky) | linux 6.18.14-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 11ba9f0dc865136174cb98834280fb21bbc950c7 < 19c7d8ac51988d053709c1e85bd8482076af845d | 19c7d8ac51988d053709c1e85bd8482076af845d |
| linux | linux | >= 5.10.250 < 5.10.252 | 5.10.252 |
| linux | linux | >= 5.15.200 < 5.15.202 | 5.15.202 |
| linux | linux | >= 5dae6b36a7cb7a4fcf4121b95e9ca7f96f816c8a < 3d94323c80d7fc4da5f10f9bb06a45d39d5d3cc4 | 3d94323c80d7fc4da5f10f9bb06a45d39d5d3cc4 |
| linux | linux | >= 6.1.163 < 6.1.165 | 6.1.165 |
| linux | linux | >= 6.12.70 < 6.12.75 | 6.12.75 |
| linux | linux | >= 6.18.10 < 6.18.14 | 6.18.14 |
| linux | linux | >= 6.6.124 < 6.6.128 | 6.6.128 |
| linux | linux | >= 986967a162142710076782d5b93daab93a892980 < a1f686d273d129b45712d95f4095843b864466bd | a1f686d273d129b45712d95f4095843b864466bd |
| linux | linux | >= c43d0e787cbba569ec9d11579ed370b50fab6c9c < 721eb342d9ba19bad5c4815ea3921465158b7362 | 721eb342d9ba19bad5c4815ea3921465158b7362 |
| linux | linux | >= cdedcd5aa3f3cb8b7ae0f87ab3a936d0bd583d66 < d34f7a8aa9a25b7e64e0e46e444697c0f702374d | d34f7a8aa9a25b7e64e0e46e444697c0f702374d |
| linux | linux | >= da5c6b8ae47e414be47e5e04def15b25d5c962dc < 91e4ff8d966978901630fc29582c1a76d3c6e46c | 91e4ff8d966978901630fc29582c1a76d3c6e46c |
| linux | linux | >= f8db6475a83649689c087a8f52486fcc53e627e9 < 1e58ae87ad1e6e24368dea9aec9048c758cd0e2b | 1e58ae87ad1e6e24368dea9aec9048c758cd0e2b |
| linux | linux | >= f8db6475a83649689c087a8f52486fcc53e627e9 < e3f000f0dee1bfab52e2e61ca6a3835d9e187e35 | e3f000f0dee1bfab52e2e61ca6a3835d9e187e35 |
| linux | linux_kernel | >= 0 < 6.18.14-1 | 6.18.14-1 |
| linux | linux_kernel | >= 0 < 5.10.252 | 5.10.252 |
| linux | linux_kernel | >= 5.10.250 < 5.10.252 | 5.10.252 |
| linux | linux_kernel | >= 5.11.0 < 5.15.202 | 5.15.202 |
| linux | linux_kernel | >= 5.15.200 < 5.15.202 | 5.15.202 |
| linux | linux_kernel | >= 5.16.0 < 6.1.165 | 6.1.165 |
| linux | linux_kernel | >= 6.1.163 < 6.1.165 | 6.1.165 |
| linux | linux_kernel | >= 6.12.70 < 6.12.75 | 6.12.75 |
| linux | linux_kernel | >= 6.13.0 < 6.18.14 | 6.18.14 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_ubuntu9.8CRITICAL
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 5.5
CVE-2026-46325 [MEDIUM] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- S390 architecture;
- Block layer subsystem;
- Cryptographic API;
- DMA engine subsystem;
- GPU drivers;
- InfiniBand drivers;
- Ethernet bonding driver;
- STMicroelectronics network drivers;
- Network drivers;
- NVME drivers;
- SCSI subsystem;
- USB over IP driver;
- File systems infrastructure;
- Ext4 file system;
- Network file system (NFS) server daemon;
- SMB network file system;
- Kernel thread helper (kthread);
- Distributed Switch Architecture;
- IPv6 networking;
- Netfilt
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-06-16·CVSS 7.8
CVE-2024-35862 [HIGH] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS
implementation in the Ubuntu Linux kernel did not properly perform
permission checks in certain situations. A local attacker could possibly
use this to gain elevated privileges. (CVE-2023-2640)
Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in
the Ubuntu Linux kernel did not properly perform permission checks in
certain situations. A local attacker could possibly use this to gain
elevated privileges. (CVE-2023-32629)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-05-19·CVSS 9.8
CVE-2026-23231 [CRITICAL] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- NVME drivers;
- Netfilter;
(CVE-2026-23112, CVE-2026-23231, CVE-2026-23273)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic,
Ubuntu
Linux kernel (Xilinx ZynqMP) vulnerabilities
vendor_ubuntu·2026-05-19·CVSS 7.8
CVE-2026-23093 [HIGH] Linux kernel (Xilinx ZynqMP) vulnerabilities
Title: Linux kernel (Xilinx ZynqMP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS
implementation in the Ubuntu Linux kernel did not properly perform
permission checks in certain situations. A local attacker could possibly
use this to gain elevated privileges. (CVE-2023-2640)
Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in
the Ubuntu Linux kernel did not properly perform permission checks in
certain situations. A local attacker could possibly use this to gain
elevated privileges. (CVE-2023-32629)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the fol
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-05-11·CVSS 9.8
CVE-2026-23231 [CRITICAL] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- NVME drivers;
- Netfilter;
(CVE-2026-23112, CVE-2026-23231, CVE-2026-23273)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-11·CVSS 7.8
CVE-2026-23273 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS
implementation in the Ubuntu Linux kernel did not properly perform
permission checks in certain situations. A local attacker could possibly
use this to gain elevated privileges. (CVE-2023-2640)
Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in
the Ubuntu Linux kernel did not properly perform permission checks in
certain situations. A local attacker could possibly use this to gain
elevated privileges. (CVE-2023-32629)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following s
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 6.4
CVE-2025-68781 [MEDIUM] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo
Rizzo discovered that some AMD Zen processors did not properly verify the
signature of CPU microcode. This flaw is known as EntrySign. A privileged
attacker could possibly use this issue to cause load malicious CPU
microcode causing loss of integrity and confidentiality. (CVE-2024-36347)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- MIPS architecture;
- PowerPC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
-
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 6.4
CVE-2025-68756 [MEDIUM] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo
Rizzo discovered that some AMD Zen processors did not properly verify the
signature of CPU microcode. This flaw is known as EntrySign. A privileged
attacker could possibly use this issue to cause load malicious CPU
microcode causing loss of integrity and confidentiality. (CVE-2024-36347)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- Network blo
Ubuntu
Linux kernel (Xilinx) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 6.4
CVE-2025-68288 [MEDIUM] Linux kernel (Xilinx) vulnerabilities
Title: Linux kernel (Xilinx) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo
Rizzo discovered that some AMD Zen processors did not properly verify the
signature of CPU microcode. This flaw is known as EntrySign. A privileged
attacker could possibly use this issue to cause load malicious CPU
microcode causing loss of integrity and confidentiality. (CVE-2024-36347)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation,
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 7.8
CVE-2023-2640 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS
implementation in the Ubuntu Linux kernel did not properly perform
permission checks in certain situations. A local attacker could possibly
use this to gain elevated privileges. (CVE-2023-2640)
Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in
the Ubuntu Linux kernel did not properly perform permission checks in
certain situations. A local attacker could possibly use this to gain
elevated privileges. (CVE-2023-32629)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystem
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 9.8
CVE-2026-23231 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- NVME drivers;
- Netfilter;
(CVE-2026-23112, CVE-2026-23231, CVE-2026-23273)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-l
Red Hat
kernel: macvlan: observe an RCU grace period in macvlan_common_newlink() error path
vendor_redhat·2026-03-20·CVSS 7.8
CVE-2026-23273 [HIGH] CWE-364 kernel: macvlan: observe an RCU grace period in macvlan_common_newlink() error path
kernel: macvlan: observe an RCU grace period in macvlan_common_newlink() error path
In the Linux kernel, the following vulnerability has been resolved:
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
valis reported that a race condition still happens after my prior patch.
macvlan_common_newlink() might have made @dev visible before
detecting an error, and its caller will directly call free_netdev(dev).
We must respect an RCU period, either in macvlan or the core networking
stack.
After adding a temporary mdelay(1000) in macvlan_forward_source_one()
to open the race window, valis repro was:
ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1
ip link set up dev p1
ip link set up dev p2
ip link add mv0 link p2 type macvlan mode source
(ip
Debian
CVE-2026-23273: linux - In the Linux kernel, the following vulnerability has been resolved: macvlan: ob...
vendor_debian·2026·CVSS 7.8
CVE-2026-23273 [HIGH] CVE-2026-23273: linux - In the Linux kernel, the following vulnerability has been resolved: macvlan: ob...
In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @dev visible before detecting an error, and its caller will directly call free_netdev(dev). We must respect an RCU period, either in macvlan or the core networking stack. After adding a temporary mdelay(1000) in macvlan_forward_source_one() to open the race window, valis repro was: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip link add mv0 link p2 type macvlan mode source (ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20 &)
VulDB
Linux Kernel up to 6.19.3 drivers/net/macvlan.c macvlan_common_newlink use after free (EUVD-2026-13609 / Nessus ID 303222)
vuldb·2026-05-23·CVSS 7.8
CVE-2026-23273 [HIGH] Linux Kernel up to 6.19.3 drivers/net/macvlan.c macvlan_common_newlink use after free (EUVD-2026-13609 / Nessus ID 303222)
A vulnerability was found in Linux Kernel up to 6.19.3. It has been classified as critical. Affected is the function macvlan_common_newlink of the file drivers/net/macvlan.c. This manipulation causes use after free.
This vulnerability is handled as CVE-2026-23273. The attack can only be done within the local network. There is not any exploit available.
Upgrading the affected component is recommended.
OSV
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
osv·2026-03-20·CVSS 7.8
CVE-2026-23273 [HIGH] macvlan: observe an RCU grace period in macvlan_common_newlink() error path
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
In the Linux kernel, the following vulnerability has been resolved:
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
valis reported that a race condition still happens after my prior patch.
macvlan_common_newlink() might have made @dev visible before
detecting an error, and its caller will directly call free_netdev(dev).
We must respect an RCU period, either in macvlan or the core networking
stack.
After adding a temporary mdelay(1000) in macvlan_forward_source_one()
to open the race window, valis repro was:
ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1
ip link set up dev p1
ip link set up dev p2
ip link add mv0 link p2 type macvlan mode source
(ip
GHSA
GHSA-r5gh-q6f7-7q3v: In the Linux kernel, the following vulnerability has been resolved:
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
vali
ghsa_unreviewed·2026-03-20
CVE-2026-23273 [HIGH] GHSA-r5gh-q6f7-7q3v: In the Linux kernel, the following vulnerability has been resolved:
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
vali
In the Linux kernel, the following vulnerability has been resolved:
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
valis reported that a race condition still happens after my prior patch.
macvlan_common_newlink() might have made @dev visible before
detecting an error, and its caller will directly call free_netdev(dev).
We must respect an RCU period, either in macvlan or the core networking
stack.
After adding a temporary mdelay(1000) in macvlan_forward_source_one()
to open the race window, valis repro was:
ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1
ip link set up dev p1
ip link set up dev p2
ip link add mv0 link p2 type macvlan mode source
(ip link add invalid% link p2 type macvlan mode source macaddr add
00:00:00:00:00
OSV
CVE-2026-23273: In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis
osv·2026-03-20·CVSS 7.8
CVE-2026-23273 [HIGH] CVE-2026-23273: In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis
In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @dev visible before detecting an error, and its caller will directly call free_netdev(dev). We must respect an RCU period, either in macvlan or the core networking stack. After adding a temporary mdelay(1000) in macvlan_forward_source_one() to open the race window, valis repro was: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip link add mv0 link p2 type macvlan mode source (ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20 &)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/19c7d8ac51988d053709c1e85bd8482076af845dhttps://git.kernel.org/stable/c/1e58ae87ad1e6e24368dea9aec9048c758cd0e2bhttps://git.kernel.org/stable/c/3d94323c80d7fc4da5f10f9bb06a45d39d5d3cc4https://git.kernel.org/stable/c/721eb342d9ba19bad5c4815ea3921465158b7362https://git.kernel.org/stable/c/91e4ff8d966978901630fc29582c1a76d3c6e46chttps://git.kernel.org/stable/c/a1f686d273d129b45712d95f4095843b864466bdhttps://git.kernel.org/stable/c/d34f7a8aa9a25b7e64e0e46e444697c0f702374dhttps://git.kernel.org/stable/c/e3f000f0dee1bfab52e2e61ca6a3835d9e187e35https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2026-03-20
Published