REDHAT-BUG-2432664: Medium severity linux/kernel vulnerability

Published Jan 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

macvlan: fix possible UAF in macvlanforwardsource()

Add RCU protection on (struct macvlansourceentry)->vlan.

Whenever macvlanhashdelsource() is called, we must clear entry->vlan pointer before RCU grace period starts.

This allows macvlanforwardsource() to skip over entries queued for freeing.

Note that macvlandev are already RCU protected, as they are embedded in a standard netdev (netdevpriv(ndev)).

https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE/T/#u

Affected Software

1 affected component
linux/kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Apply a code change that adds RCU protection on struct macvlan_source_entry->vlan and ensure macvlan_hash_del_source() clears entry->vlan pointer before the RCU grace period starts so macvlan_forward_source() will skip entries queued for freeing.

    Linux kernel (macvlan) macvlan_source_entry->vlan RCU protection / macvlan_hash_del_source behavior = clear pointer before RCU grace period

Event History

Jan 25, 2026
Data Sourced
via Red Hat·03:01 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

Which kernel networking functionality should be prioritized for review?

Review systems using the macvlan source-entry and source-forwarding paths. The issue involves entries processed by macvlan_forward_source() while they are being removed through macvlan_hash_del_source().

2

What condition creates the unsafe access?

An entry can be queued for freeing while its vlan pointer remains available to the forwarding path. Without clearing that pointer before the RCU grace period begins, macvlan_forward_source() may access an entry that is being freed.

3

How does the resolved code prevent the issue?

The fix adds RCU protection for the vlan member of macvlan_source_entry and clears entry->vlan before the RCU grace period starts. This lets the forwarding path skip entries queued for freeing.

4

Which Red Hat advisories are associated with this issue?

The provided references list RHSA-2026:3964 and RHSA-2026:3966.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203