CVE-2026-23124

A flaw was found in the Linux kernel's IPv6 neighbor discovery component. A remote attacker on an adjacent network can exploit a data race in the ndisc_router_discovery function by sending specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement (RA) messages. This allows for inconsistent updates to the ra_mtu value, leading to transient or incorrect Maximum Transmission Unit (MTU) state and spurious interface information notifications. The primary impact is limited availability of the affected system.

A data race exists in IPv6 neighbor discovery because ndisc_router_discovery can read and write in6_dev ra_mtu without holding a lock while processing Router Advertisement MTU options. Under concurrent RA processing the ra_mtu value can be observed and updated inconsistently which can result in transient or incorrect MTU state and spurious ifinfo notifications. For the CVSS the PR is N because the input comes from ICMPv6 Router Advertisements and does not require local privileges on the target. The issue is network reachable in an adjacent network because RA traffic is typically limited to the local link. Realistic impact is limited availability and configuration stability rather than a direct kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.