CVE-2026-23175: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23175 is a vulnerability in the Linux kernel's CPSW (Common Platform Switch) network driver affecting the ndo_set_rx_mode callback execution context. The issue was introduced after commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL (Route Netlink) lock for certain IPv6 multicast operations, causing the CPSW driver to call VLAN-related functions without the required RTNL lock held, triggering kernel warnings. It affects the Linux kernel and was published on February 14, 2026. The CVSS v3.1 base score is 7.0 (High) (Feedly).

The root cause is a locking discipline violation (CWE-667: Improper Locking) in the CPSW network driver. When IPV6_ADD_MEMBERSHIP or MCAST_JOIN_GROUP socket options are set, the kernel path do_ipv6_setsockopt → __ipv6_sock_mc_join → __ipv6_dev_mc_inc → igmp6_group_added → __dev_mc_add → __hw_addr_ref_sync_dev → cpsw_add_mc_addr → vlan_for_each is triggered without the RTNL lock, but vlan_for_each asserts that the RTNL lock must be held. The fix involves executing the ndo_set_rx_mode callback in a work queue to ensure proper locking context. Exploitation requires local access with low privileges and high attack complexity (Feedly).

Successful exploitation can result in high impacts to confidentiality, integrity, and availability on the affected system. The kernel warning and potential race condition arising from the missing RTNL lock could lead to memory corruption, system instability, or a kernel panic on devices using the CPSW network driver (such as BeagleBone Black and similar AM33XX-based embedded platforms). The scope is limited to the local system without privilege escalation beyond the kernel context (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2026-23175. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Nessus plugin 299117 (Tenable, Feedly).

The fix involves modifying the CPSW driver to execute the ndo_set_rx_mode callback within a work queue, ensuring the RTNL lock is properly held when vlan_for_each is called. Users should apply the upstream Linux kernel patches referenced in the kernel stable tree (commits 0b8c878d1173 and 488009aa62bb). Administrators running affected embedded Linux distributions (e.g., Yocto-based systems on AM33XX/BeagleBone Black hardware) should update to a patched kernel version as soon as one is available from their distribution vendor (Feedly).