CVE-2026-23273

A flaw was found in the Linux kernel's macvlan module. A race condition can occur during the creation of a macvlan interface, where the device might be made visible before an error is detected. This can lead to a use-after-free vulnerability, allowing a local attacker to cause a system crash (Denial of Service) or potentially execute arbitrary code.

This vulnerability affects systems using macvlan network interfaces in source mode. The race occurs when creating a macvlan device with an invalid name while traffic is flowing through the parent interface. The device becomes visible to RCU readers before error detection, and subsequent cleanup frees the device without waiting for an RCU grace period, leading to UAF in macvlan_forward_source().

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the macvlan module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.