Executive brief
A race condition vulnerability was identified in the Linux kernel's IPvlan driver, which manages virtual network interfaces. This flaw could allow a local attacker to cause system instability or potentially gain unauthorized access to data by exploiting improper synchronization during network address updates. The issue primarily affects systems using IPv6 configurations on virtualized network ports.
Technical details
A race condition exists in the Linux kernel ipvlan driver because the 'addrs_lock' was implemented per virtual device rather than per port. This architectural oversight failed to account for IPv6 address changes that occur outside of the Routing Netlink (RTNL) lock, specifically within 'ipvlan_addr6_event()'. An attacker with local access could exploit this to cause a race condition during address addition or removal, leading to a false-negative in 'ipvlan_addr_busy()' or inconsistent states in the address hash table. The fix involves migrating 'addrs_lock' to a per-port scope and ensuring it is properly held during 'ipvlan_open' and 'ipvlan_close' operations.
Affected products
- Linux Linux 8230819494b3 to 3c149b662cbb202a450e81f938e702ba333864ad
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2026-01-30: patched: Fix committed to Linux stable tree.
- 2026-02-04: disclosed: CVE published.
References
- https://git.kernel.org/stable/c/04ba6de6eff61238e5397c14ac26a6578c7735a5
- https://git.kernel.org/stable/c/1f300c10d92c547c3a7d978e1212ff52f18256ed
- https://git.kernel.org/stable/c/3c149b662cbb202a450e81f938e702ba333864ad
- https://git.kernel.org/stable/c/6a81e2db096913d7e43aada1c350c1282e76db39
- https://git.kernel.org/stable/c/70feb16e3fbfb10b15de1396557c38e99f1ab8df
- https://git.kernel.org/stable/c/88f83e6c9cdb46b8c8ddd0ba01393362963cf589
- https://git.kernel.org/stable/c/d3ba32162488283c0a4c5bedd8817aec91748802