CVE-2026-23124: ipv6: annotate data-race in ndisc_router_discovery()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: annotate data-race in ndiscrouterdiscovery()
syzbot found that ndiscrouterdiscovery() could read and write in6dev->ramtu without holding a lock [1]
This looks fine, IFLAINET6RAMTU is best effort.
Add READONCE()/WRITEONCE() to document the race.
Note that we might also reject illegal MTU values (mtu < IPV6MINMTU || mtu > skb->dev->mtu) in a future patch.
[1] BUG: KCSAN: data-race in ndiscrouterdiscovery / ndiscrouterdiscovery
read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1: ndiscrouterdiscovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndiscrcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6protocoldeliverrcu+0xb2a/0x10d0 net/ipv6/ip6input.c:438 ip6inputfinish+0xf0/0x1d0 net/ipv6/ip6input.c:489 NFHOOK include/linux/netfilter.h:318 [inline] ip6input+0x5e/0x140 net/ipv6/ip6input.c:500 ip6mcinput+0x27c/0x470 net/ipv6/ip6input.c:590 dstinput include/net/dst.h:474 [inline] ip6rcvfinish+0x336/0x340 net/ipv6/ip6input.c:79 ...
write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0: ndiscrouterdiscovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559 ndiscrcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6protocoldeliverrcu+0xb2a/0x10d0 net/ipv6/ip6input.c:438 ip6inputfinish+0xf0/0x1d0 net/ipv6/ip6input.c:489 NFHOOK include/linux/netfilter.h:318 [inline] ip6input+0x5e/0x140 net/ipv6/ip6input.c:500 ip6mcinput+0x27c/0x470 net/ipv6/ip6input.c:590 dstinput include/net/dst.h:474 [inline] ip6rcvfinish+0x336/0x340 net/ipv6/ip6input.c:79 ...
value changed: 0x00000000 -> 0xe5400659
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23124?
CVE-2026-23124 is considered a medium severity vulnerability due to its potential to cause inconsistent states in the Linux kernel.
How do I fix CVE-2026-23124?
To fix CVE-2026-23124, ensure that you update your Linux kernel to a version that includes the patch for this vulnerability.
Which Linux kernel versions are affected by CVE-2026-23124?
CVE-2026-23124 affects Linux kernel versions from 5.15 up to 6.19-rc6.
What causes the vulnerability CVE-2026-23124?
CVE-2026-23124 is caused by a data race condition in the ndisc_router_discovery() function in the Linux kernel.
Is CVE-2026-23124 remotely exploitable?
CVE-2026-23124 is not directly remotely exploitable, but it may lead to system instability if exploited locally.