CVE-2026-23103: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23103 is an improper locking vulnerability in the Linux kernel's ipvlan network driver that can lead to a local denial of service. The flaw stems from the addrs_lock being scoped per ipvlan device rather than per port, which was originally written under the assumption that all address changes occur under RTNL (Routing Netlink) lock — an assumption that does not hold for IPv6. Affected kernel versions span from 4.17 up to (but not including) 5.10.249, 5.11–5.15.199, 5.16–6.1.162, 6.2–6.6.122, 6.7–6.12.68, and 6.13–6.18.8, as well as 6.19-rc1 through rc6. It was published on February 4, 2026, with patches added on March 19, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, CVE.org).

The root cause is classified as CWE-667 (Improper Locking). The original ipvlan code assumed all address modifications would occur under the global RTNL lock, but IPv6 address events (specifically ipvlan_addr6_event()) can be triggered without holding rtnl_lock, creating a race condition. This leads to two concrete issues: (1) a false-negative in ipvlan_addr_busy() where one CPU iterates port addresses under one spinlock while another CPU adds an IP under a different per-device lock, and (2) a race condition because ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock instances. Additionally, ipvlan_open and ipvlan_close were missing lock acquisitions entirely. The fix introduces a per-port addrs_lock to serialize all address operations correctly (Feedly, Kernel Patch).

Successful exploitation of this vulnerability by a local, low-privileged user can cause a denial of service condition on the affected system, with a high availability impact and no confidentiality or integrity impact. The vulnerability is locally exploitable and limited in scope to the affected system, making lateral movement or data exfiltration unlikely as direct consequences. Systems using ipvlan network interfaces with IPv6 addressing are most at risk, particularly in containerized or virtualized environments where ipvlan is commonly deployed (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-23103. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, and the race condition is described by the kernel developers themselves as "highly unlikely" to be triggered simultaneously on two CPUs, further reducing practical exploitability (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to the following fixed versions or later: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, or 6.19-rc7. Patches are available via the stable kernel tree at git.kernel.org. Major distributions including Ubuntu (USN-8162-1, USN-8180-x series, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), SUSE (SUSE-SU-2026:1661-1, SUSE-SU-2026:1668-1), openSUSE, Oracle Linux, and Amazon Linux 2 have issued updated kernel packages (Ubuntu Advisory, SUSE Advisory, AWS ALAS). No configuration-based workaround is available; upgrading the kernel is the only remediation.