CVE-2026-23004: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23004 is a race condition vulnerability in the Linux kernel's destination (dst) subsystem, specifically in the rt6_uncached_list_del() and rt_del_uncached_list() functions affecting both IPv6 and IPv4 routing code paths. The flaw was discovered via syzbot fuzzing and disclosed on January 25, 2026. It affects Linux kernel versions 3.6.1 through 6.6.129, 6.12.0 through 6.12.77, and 6.18.0 through 6.18.6. It carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). The root cause is that rt6_uncached_list_del() does not acquire the ul->lock spinlock before checking whether a routing entry's uncached list is empty. On a multi-CPU system, one CPU can write list->next (via WRITE_ONCE) during INIT_LIST_HEAD() while a second CPU concurrently frees the same object; when the second CPU then attempts to write list->prev, it accesses already-freed memory, triggering a KASAN slab-use-after-free crash in rt6_uncached_list_flush_dev(). The fix involves using list_del_init_careful() and list_empty_careful(), or ensuring the spinlock is always held when rt->dst.rt_uncached_list has been set. An analogous race exists in the IPv4 path (rt_del_uncached_list()). Exploitation requires triggering network configuration changes such as interface down transitions or network namespace cleanup (Red Hat Bugzilla).

A low-privileged local attacker can exploit this race condition to cause a kernel panic (denial of service) via a KASAN slab-use-after-free write in the IPv6 or IPv4 routing subsystem. There is no confidentiality or integrity impact; the sole consequence is system unavailability due to kernel crash. The vulnerability affects any Linux system running a vulnerable kernel version that processes network namespace or interface lifecycle events (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG: KASAN: slab-use-after-free in INIT_LIST_HEAD, list_del_init, rt6_uncached_list_flush_dev, or rt6_disable_ip at net/ipv6/route.c.
• Logs: Stack traces referencing addrconf_ifdown, addrconf_notify, netif_close_many, unregister_netdevice_many_notify, or cleanup_net in conjunction with the above KASAN report.
• Process: Unexpected kernel worker thread (kworker) crashes or system reboots coinciding with network interface down events or network namespace teardown operations.
• System: Kernel panic or sudden system restart during network reconfiguration, particularly when multiple CPUs are active and network namespaces are being cleaned up (Red Hat Bugzilla).

Update the Linux kernel to a patched version: 6.6.130 or later, 6.12.78 or later, or 6.18.7 or later. Patch commits are available in the Linux kernel stable tree (kernel.org patches). Distribution-specific updates have been issued by SUSE (SUSE-SU-2026:1686-1, SUSE-SU-2026:1698-1, SUSE-SU-2026:1708-1, SUSE-SU-2026:1725-1, SUSE-SU-2026:1735-1, SUSE-SU-2026:1765-1, SUSE-SU-2026:1773-1), Debian (DSA-6238-1), Amazon Linux 2023 (ALAS2023-2026-1594), and Oracle Linux. As a short-term workaround, restricting local system access to trusted users reduces exposure, since the vulnerability requires local low-privileged access to trigger (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability received routine coverage from Linux distribution security teams, with patch advisories issued by SUSE, Debian, Oracle Linux, Amazon Linux, and openSUSE. No notable independent researcher commentary or significant social media discussion has been identified beyond automated CVE tracking feeds and vendor security announcements.