CVE-2026-23124: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23124 is a data-race vulnerability in the Linux kernel's IPv6 Neighbor Discovery (NDISC) implementation, specifically within the ndisc_router_discovery() function in net/ipv6/ndisc.c. The flaw allows concurrent read and write access to the in6_dev->ra_mtu (Router Advertisement MTU) variable without proper synchronization, as detected by syzbot via the Kernel Concurrency Sanitizer (KCSAN). Affected kernel versions span multiple stable branches: 5.15.x through 5.15.198, 5.16 through 6.1.161, 6.2 through 6.6.121, 6.7 through 6.12.67, and 6.13 through 6.18.7. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a concurrent memory access (CWE-362: Race Condition) in ndisc_router_discovery() at lines 1558–1559 of net/ipv6/ndisc.c, where two tasks running on separate CPUs can simultaneously read and write the in6_dev->ra_mtu field without holding a lock. The fix annotates these accesses with READ_ONCE()/WRITE_ONCE() macros to document and safely handle the benign race, as IFLA_INET6_RA_MTU is considered best-effort. The vulnerability was surfaced by syzbot's KCSAN tooling, which reported the unsynchronized 4-byte accesses at address 0xffff888119809c20 during concurrent IPv6 Router Advertisement message processing (Feedly, Kernel Patch).

Successful exploitation of this race condition can result in a denial-of-service (DoS) condition through kernel instability or unpredictable behavior when processing IPv6 Router Advertisement messages. The vulnerability has no confidentiality or integrity impact; only availability is affected, as concurrent tasks processing NDISC messages may trigger kernel crashes or undefined behavior. The scope is limited to the local system, and there is no known path for lateral movement or data exfiltration (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges to trigger, limiting its practical attack surface. The EPSS score is 0.024% (very low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Patches are available across all affected stable kernel branches. Organizations should upgrade to the following fixed versions: 5.15.199 or later (5.15.x branch), 6.1.162 or later (5.16–6.1.x branch), 6.6.122 or later (6.2–6.6.x branch), 6.12.68 or later (6.7–6.12.x branch), and 6.18.8 or later (6.13+ branch). Patches are available at the official kernel stable repositories on git.kernel.org. As a temporary measure, restricting local user access and applying network-level controls to limit exposure to untrusted IPv6 Router Advertisement messages may reduce risk (Feedly, Kernel Patch).

The vulnerability has been addressed in multiple downstream distributions, including Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1, USN-8393-1) and Oracle Linux (ELISA-2026-50160, ELSA-2026-50232), as well as Amazon Linux 2 kernel updates. Tenable Nessus and Qualys scanners have added detection plugins for this CVE. No notable independent researcher commentary or significant social media discussion has been identified (Ubuntu USN-8162-1, Ubuntu USN-8180-1).