High 7.8Published Jan 25, 2026

CVE-2026-23001macvlan: fix possible UAF in macvlan_forward_source()

Updated under an hour ago (Oct 28, 2026, 1:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing. Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)). https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 79cf79abce71eb7dbc40e2f3121048ca5405cb47 before 8133e85b8a3ec9f10d861e0002ec6037256e987e; from 79cf79abce71eb7dbc40e2f3121048ca5405cb47 before 484919832e2db6ce1e8add92c469e5d459a516b5; from 79cf79abce71eb7dbc40e2f3121048ca5405cb47 before 232afc74a6dde0fe1830988e5827921f5ec9bb3f; 79cf79abce71eb7dbc40e2f3121048ca5405cb47 builds before 15f6faf36e162532bec5cc05eb3fc622108bf2ed; from 79cf79abce71eb7dbc40e2f3121048ca5405cb47 before 8518712a2ca952d6da2238c6f0a16b4ae5ea3f13; 79cf79abce71eb7dbc40e2f3121048ca5405cb47 builds before 6dbead9c7677186f22b7981dd085a0feec1f038e; from 79cf79abce71eb7dbc40e2f3121048ca5405cb47 before 7470a7a63dc162f07c26dbf960e41ee1e248d80e	CNA record
linux linux_kernel linux:linux_kernel	from 3.18.1 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.67; from 6.13 before 6.18.7; 3.18; 6.19; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/8133e85b8a3ec9f10d861e0002ec6037256e987e	patch
https://git.kernel.org/stable/c/484919832e2db6ce1e8add92c469e5d459a516b5	patch
https://git.kernel.org/stable/c/232afc74a6dde0fe1830988e5827921f5ec9bb3f	patch
https://git.kernel.org/stable/c/15f6faf36e162532bec5cc05eb3fc622108bf2ed	patch
https://git.kernel.org/stable/c/8518712a2ca952d6da2238c6f0a16b4ae5ea3f13	patch
https://git.kernel.org/stable/c/6dbead9c7677186f22b7981dd085a0feec1f038e	patch
https://git.kernel.org/stable/c/7470a7a63dc162f07c26dbf960e41ee1e248d80e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.