CVE-2026-23203: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23203 is a race condition vulnerability in the Linux kernel's cpsw_new network driver where the ndo_set_rx_mode callback executes without proper RTNL lock synchronization during IPv6 multicast operations. The vulnerability was introduced as a side effect of commit 1767bb2d47b7, which removed the RTNL lock requirement for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. It affects Linux kernel versions 6.17 through 6.18 (prior to 6.18.10) and 6.19-rc1 through 6.19-rc8. It was published on February 14, 2026, with patches added to the stable tree on March 19, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Feedly).

The root cause is a missing synchronization guard (CWE-667: Improper Locking) in the cpsw_new driver's cpsw_ndo_set_rx_mode() function. When a low-privileged local user performs an IPv6 multicast group join (e.g., via setsockopt with MCAST_JOIN_GROUP or IPV6_ADD_MEMBERSHIP), the call chain igmp6_group_added → __hw_addr_ref_sync_dev → cpsw_add_mc_addr → vlan_for_each is triggered without holding the RTNL lock. Because vlan_for_each() asserts RTNL lock ownership, this results in a kernel WARN_ON assertion failure. The fix offloads ndo_set_rx_mode processing to a work queue to avoid the synchronization conflict (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes RTNL assertion failures and kernel warnings, leading to kernel instability, potential system hangs, or crashes — resulting in a high availability impact with no confidentiality or integrity compromise. The vulnerability primarily affects embedded systems and IoT devices using the cpsw_new driver (e.g., BeagleBone Black boards running TI AM33XX SoCs) with VLAN interfaces configured. A local attacker with low privileges can trigger a denial-of-service condition by repeatedly joining IPv6 multicast groups on affected systems (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The attack requires local access with low privileges, limiting the attack surface primarily to multi-user embedded or IoT systems. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log containing WARNING: net/8021q/vlan_core.c:236 and RTNL: assertion failed at net/8021q/vlan_core.c.
• Logs: Call traces referencing vlan_for_each, cpsw_add_mc_addr, __hw_addr_ref_sync_dev, igmp6_group_added, and __ipv6_dev_mc_inc in kernel logs.
• Process: Processes (e.g., rpcbind or similar network daemons) repeatedly invoking setsockopt with IPV6_ADD_MEMBERSHIP or MCAST_JOIN_GROUP on systems with VLAN interfaces and the cpsw_new driver loaded.

Update the Linux kernel to version 6.18.10 or later for systems in the 6.17–6.18 series; for 6.19-rc systems, apply the stable patches from commits c0b5dc73a38f954e780f93a549b8fe225235c07a and d5b3a669866977dc87fd56fcf00a70df1536d258 or upgrade to the final 6.19 release. As a temporary workaround where patching is not immediately feasible, restrict IPv6 multicast group join operations or disable VLAN interfaces on affected systems. Prioritize remediation on embedded and IoT devices (e.g., BeagleBone Black) using the cpsw_new driver with VLAN and IPv6 multicast configurations (Feedly, Kernel Patch 1, Kernel Patch 2).