CVE-2026-23103

A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrs_lock was incorrectly used instead of a per-port lock, and some code paths (ipvlan_open/ipvlan_close) failed to acquire the lock entirely. For IPv6 address changes that don't require RTNL lock, concurrent address additions could cause false-negative results from ipvlan_addr_busy() or race conditions when adding addresses to the hash table.

This race condition has limited practical exploitability as it requires precise timing of concurrent IPv6 address changes on ipvlan interfaces. The upstream commit describes it as "a very minor problem" since simultaneous ipvlan_add_addr() calls on multiple CPUs are highly unlikely. The potential consequences are address conflict detection failures or hash table corruption, not direct memory corruption or code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ipvlan module from being loaded if IP-based virtual LAN networking is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.