CVE-2026-23103 (GCVE-0-2026-23103)
Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-09-08 08:44
VLAI
EPSS
VEX
Title
ipvlan: Make the addrs_lock be per port
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvlan: Make the addrs_lock be per port
Make the addrs_lock be per port, not per ipvlan dev.
Initial code seems to be written in the assumption,
that any address change must occur under RTNL.
But it is not so for the case of IPv6. So
1) Introduce per-port addrs_lock.
2) It was needed to fix places where it was forgotten
to take lock (ipvlan_open/ipvlan_close)
This appears to be a very minor problem though.
Since it's highly unlikely that ipvlan_add_addr() will
be called on 2 CPU simultaneously. But nevertheless,
this could cause:
1) False-negative of ipvlan_addr_busy(): one interface
iterated through all port->ipvlans + ipvlan->addrs
under some ipvlan spinlock, and another added IP
under its own lock. Though this is only possible
for IPv6, since looks like only ipvlan_addr6_event() can be
called without rtnl_lock.
2) Race since ipvlan_ht_addr_add(port) is called under
different ipvlan->addrs_lock locks
This should not affect performance, since add/remove IP
is a rare situation and spinlock is not taken on fast
paths.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 20:21 UTC
Assigner
References
8 references
Impacted products
5 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
8230819494b3bf284ca7262ac5f877333147b937 , < 3c149b662cbb202a450e81f938e702ba333864ad
(git)
Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 70feb16e3fbfb10b15de1396557c38e99f1ab8df (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 88f83e6c9cdb46b8c8ddd0ba01393362963cf589 (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 04ba6de6eff61238e5397c14ac26a6578c7735a5 (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 1f300c10d92c547c3a7d978e1212ff52f18256ed (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 6a81e2db096913d7e43aada1c350c1282e76db39 (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < d3ba32162488283c0a4c5bedd8817aec91748802 (git) |
guessed | |
| Linux | Linux |
Affected:
4.17
Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.249 , ≤ 5.10.* (semver) Unaffected: 5.15.199 , ≤ 5.15.* (semver) Unaffected: 6.1.162 , ≤ 6.1.* (semver) Unaffected: 6.6.122 , ≤ 6.6.* (semver) Unaffected: 6.12.68 , ≤ 6.12.* (semver) Unaffected: 6.18.8 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix) |
guessed | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
guessed | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
guessed | |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T20:21:03.730200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T20:21:13.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:44:55.724Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ipvlan/ipvlan.h",
"drivers/net/ipvlan/ipvlan_core.c",
"drivers/net/ipvlan/ipvlan_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c149b662cbb202a450e81f938e702ba333864ad",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "70feb16e3fbfb10b15de1396557c38e99f1ab8df",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "88f83e6c9cdb46b8c8ddd0ba01393362963cf589",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "04ba6de6eff61238e5397c14ac26a6578c7735a5",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "1f300c10d92c547c3a7d978e1212ff52f18256ed",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "6a81e2db096913d7e43aada1c350c1282e76db39",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "d3ba32162488283c0a4c5bedd8817aec91748802",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ipvlan/ipvlan.h",
"drivers/net/ipvlan/ipvlan_core.c",
"drivers/net/ipvlan/ipvlan_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.249",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.199",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.162",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.122",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.68",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.249",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.199",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.162",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.122",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.68",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.8",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: Make the addrs_lock be per port\n\nMake the addrs_lock be per port, not per ipvlan dev.\n\nInitial code seems to be written in the assumption,\nthat any address change must occur under RTNL.\nBut it is not so for the case of IPv6. So\n\n1) Introduce per-port addrs_lock.\n\n2) It was needed to fix places where it was forgotten\nto take lock (ipvlan_open/ipvlan_close)\n\nThis appears to be a very minor problem though.\nSince it\u0027s highly unlikely that ipvlan_add_addr() will\nbe called on 2 CPU simultaneously. But nevertheless,\nthis could cause:\n\n1) False-negative of ipvlan_addr_busy(): one interface\niterated through all port-\u003eipvlans + ipvlan-\u003eaddrs\nunder some ipvlan spinlock, and another added IP\nunder its own lock. Though this is only possible\nfor IPv6, since looks like only ipvlan_addr6_event() can be\ncalled without rtnl_lock.\n\n2) Race since ipvlan_ht_addr_add(port) is called under\ndifferent ipvlan-\u003eaddrs_lock locks\n\nThis should not affect performance, since add/remove IP\nis a rare situation and spinlock is not taken on fast\npaths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Creating and managing ipvlan devices requires local access via netlink/rtnetlink syscalls. This is not remotely reachable.\nAC:L - The attacker controls both sides of the race by creating multiple ipvlan devices on the same port and triggering concurrent open/address-change operations. The race is reliably reproducible with retries.\nPR:L - ipvlan creation requires CAP_NET_ADMIN, which is obtainable via user namespaces (unshare -Urn) on a veth device. The ns_capable check on the physical device\u0027s user_ns is satisfied when both are in the user\u0027s namespace.\nUI:N - No user interaction is needed. The attacker can create ipvlan devices and trigger the race entirely on their own.\nS:U - This is a standard kernel privilege escalation vulnerability with no security boundary crossing (no VM escape, no IOMMU bypass).\nC:H - The race leads to a use-after-free in the per-port hash table used on the packet data path. The dangling pointer allows reading freed/reallocated memory contents during hash table lookups.\nI:H - The UAF in the hash table allows an attacker to reallocate the freed ipvl_addr structure with controlled data, enabling heap spraying and potential code execution through corrupted hash table entries.\nA:H - The dangling pointer in the hash table will cause a kernel crash when the freed memory is accessed during packet processing, leading to a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:20:16.355Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c149b662cbb202a450e81f938e702ba333864ad"
},
{
"url": "https://git.kernel.org/stable/c/70feb16e3fbfb10b15de1396557c38e99f1ab8df"
},
{
"url": "https://git.kernel.org/stable/c/88f83e6c9cdb46b8c8ddd0ba01393362963cf589"
},
{
"url": "https://git.kernel.org/stable/c/04ba6de6eff61238e5397c14ac26a6578c7735a5"
},
{
"url": "https://git.kernel.org/stable/c/1f300c10d92c547c3a7d978e1212ff52f18256ed"
},
{
"url": "https://git.kernel.org/stable/c/6a81e2db096913d7e43aada1c350c1282e76db39"
},
{
"url": "https://git.kernel.org/stable/c/d3ba32162488283c0a4c5bedd8817aec91748802"
}
],
"title": "ipvlan: Make the addrs_lock be per port",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23103",
"datePublished": "2026-02-04T16:08:24.771Z",
"dateReserved": "2026-01-13T15:37:45.966Z",
"dateUpdated": "2026-09-08T08:44:55.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-23103",
"date": "2026-09-17",
"epss": "0.00111",
"percentile": "0.01499"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-23103\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-04T17:16:21.177\",\"lastModified\":\"2026-07-14T13:18:24.807\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipvlan: Make the addrs_lock be per port\\n\\nMake the addrs_lock be per port, not per ipvlan dev.\\n\\nInitial code seems to be written in the assumption,\\nthat any address change must occur under RTNL.\\nBut it is not so for the case of IPv6. So\\n\\n1) Introduce per-port addrs_lock.\\n\\n2) It was needed to fix places where it was forgotten\\nto take lock (ipvlan_open/ipvlan_close)\\n\\nThis appears to be a very minor problem though.\\nSince it\u0027s highly unlikely that ipvlan_add_addr() will\\nbe called on 2 CPU simultaneously. But nevertheless,\\nthis could cause:\\n\\n1) False-negative of ipvlan_addr_busy(): one interface\\niterated through all port-\u003eipvlans + ipvlan-\u003eaddrs\\nunder some ipvlan spinlock, and another added IP\\nunder its own lock. Though this is only possible\\nfor IPv6, since looks like only ipvlan_addr6_event() can be\\ncalled without rtnl_lock.\\n\\n2) Race since ipvlan_ht_addr_add(port) is called under\\ndifferent ipvlan-\u003eaddrs_lock locks\\n\\nThis should not affect performance, since add/remove IP\\nis a rare situation and spinlock is not taken on fast\\npaths.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nipvlan: Hacer que el addrs_lock sea por puerto\\n\\nHacer que el addrs_lock sea por puerto, no por dispositivo ipvlan.\\n\\nEl c\u00f3digo inicial parece estar escrito bajo la suposici\u00f3n de que cualquier cambio de direcci\u00f3n debe ocurrir bajo RTNL. Pero no es as\u00ed para el caso de IPv6. As\u00ed que\\n\\n1) Introducir addrs_lock por puerto.\\n\\n2) Fue necesario corregir lugares donde se olvid\u00f3 tomar el bloqueo (ipvlan_open/ipvlan_close)\\n\\nEsto parece ser un problema muy menor, sin embargo. Ya que es muy poco probable que ipvlan_add_addr() sea llamado en 2 CPU simult\u00e1neamente. Pero, sin embargo, esto podr\u00eda causar:\\n\\n1) Falso negativo de ipvlan_addr_busy(): una interfaz iter\u00f3 a trav\u00e9s de todos los port-\u0026gt;ipvlans + ipvlan-\u0026gt;addrs bajo alg\u00fan spinlock de ipvlan, y otra a\u00f1adi\u00f3 IP bajo su propio bloqueo. Aunque esto solo es posible para IPv6, ya que parece que solo ipvlan_addr6_event() puede ser llamado sin rtnl_lock.\\n\\n2) Condici\u00f3n de carrera ya que ipvlan_ht_addr_add(port) es llamado bajo diferentes bloqueos ipvlan-\u0026gt;addrs_lock.\\n\\nEsto no deber\u00eda afectar el rendimiento, ya que a\u00f1adir/eliminar IP es una situaci\u00f3n rara y el spinlock no se toma en rutas r\u00e1pidas.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ipvlan/ipvlan.h\",\"drivers/net/ipvlan/ipvlan_core.c\",\"drivers/net/ipvlan/ipvlan_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8230819494b3bf284ca7262ac5f877333147b937\",\"lessThan\":\"3c149b662cbb202a450e81f938e702ba333864ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8230819494b3bf284ca7262ac5f877333147b937\",\"lessThan\":\"70feb16e3fbfb10b15de1396557c38e99f1ab8df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8230819494b3bf284ca7262ac5f877333147b937\",\"lessThan\":\"88f83e6c9cdb46b8c8ddd0ba01393362963cf589\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8230819494b3bf284ca7262ac5f877333147b937\",\"lessThan\":\"04ba6de6eff61238e5397c14ac26a6578c7735a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8230819494b3bf284ca7262ac5f877333147b937\",\"lessThan\":\"1f300c10d92c547c3a7d978e1212ff52f18256ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8230819494b3bf284ca7262ac5f877333147b937\",\"lessThan\":\"6a81e2db096913d7e43aada1c350c1282e76db39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8230819494b3bf284ca7262ac5f877333147b937\",\"lessThan\":\"d3ba32162488283c0a4c5bedd8817aec91748802\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ipvlan/ipvlan.h\",\"drivers/net/ipvlan/ipvlan_core.c\",\"drivers/net/ipvlan/ipvlan_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.249\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.199\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.162\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.122\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.68\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.8\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T20:21:03.730200Z\",\"id\":\"CVE-2026-23103\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"5.10.249\",\"matchCriteriaId\":\"A01BEBA6-BA9F-40D5-99D9-19EB7F39672F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.199\",\"matchCriteriaId\":\"A247FBA6-BEB9-484F-B892-DD5517949CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.162\",\"matchCriteriaId\":\"6579E0D4-0641-479D-A4C3-0EF618798C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.122\",\"matchCriteriaId\":\"8EAAE395-0162-4BAF-9AD5-E9AF3C869C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.68\",\"matchCriteriaId\":\"52F38E19-0FDD-4992-9D6D-D4169D689598\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.8\",\"matchCriteriaId\":\"E65C6E79-7EBE-4C77-93F0-818CF5B38F4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04ba6de6eff61238e5397c14ac26a6578c7735a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1f300c10d92c547c3a7d978e1212ff52f18256ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c149b662cbb202a450e81f938e702ba333864ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6a81e2db096913d7e43aada1c350c1282e76db39\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70feb16e3fbfb10b15de1396557c38e99f1ab8df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88f83e6c9cdb46b8c8ddd0ba01393362963cf589\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3ba32162488283c0a4c5bedd8817aec91748802\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-09-17T12:41:10+00:00",
"cve": "CVE-2026-23103",
"id": "CVE-2026-23103",
"initial_release_date": "2026-02-04T00:00:00+00:00",
"product_status:fixed": "150",
"product_status:known_affected": "184",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ipvlan: Make the addrs_lock be per port",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23103.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-09-08T08:44:55.724Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23103\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T20:21:03.730200Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T20:21:08.974Z\"}}], \"cna\": {\"title\": \"ipvlan: Make the addrs_lock be per port\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Creating and managing ipvlan devices requires local access via netlink/rtnetlink syscalls. This is not remotely reachable.\\nAC:L - The attacker controls both sides of the race by creating multiple ipvlan devices on the same port and triggering concurrent open/address-change operations. The race is reliably reproducible with retries.\\nPR:L - ipvlan creation requires CAP_NET_ADMIN, which is obtainable via user namespaces (unshare -Urn) on a veth device. The ns_capable check on the physical device\u0027s user_ns is satisfied when both are in the user\u0027s namespace.\\nUI:N - No user interaction is needed. The attacker can create ipvlan devices and trigger the race entirely on their own.\\nS:U - This is a standard kernel privilege escalation vulnerability with no security boundary crossing (no VM escape, no IOMMU bypass).\\nC:H - The race leads to a use-after-free in the per-port hash table used on the packet data path. The dangling pointer allows reading freed/reallocated memory contents during hash table lookups.\\nI:H - The UAF in the hash table allows an attacker to reallocate the freed ipvl_addr structure with controlled data, enabling heap spraying and potential code execution through corrupted hash table entries.\\nA:H - The dangling pointer in the hash table will cause a kernel crash when the freed memory is accessed during packet processing, leading to a kernel oops or panic.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8230819494b3bf284ca7262ac5f877333147b937\", \"lessThan\": \"3c149b662cbb202a450e81f938e702ba333864ad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8230819494b3bf284ca7262ac5f877333147b937\", \"lessThan\": \"70feb16e3fbfb10b15de1396557c38e99f1ab8df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8230819494b3bf284ca7262ac5f877333147b937\", \"lessThan\": \"88f83e6c9cdb46b8c8ddd0ba01393362963cf589\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8230819494b3bf284ca7262ac5f877333147b937\", \"lessThan\": \"04ba6de6eff61238e5397c14ac26a6578c7735a5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8230819494b3bf284ca7262ac5f877333147b937\", \"lessThan\": \"1f300c10d92c547c3a7d978e1212ff52f18256ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8230819494b3bf284ca7262ac5f877333147b937\", \"lessThan\": \"6a81e2db096913d7e43aada1c350c1282e76db39\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8230819494b3bf284ca7262ac5f877333147b937\", \"lessThan\": \"d3ba32162488283c0a4c5bedd8817aec91748802\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ipvlan/ipvlan.h\", \"drivers/net/ipvlan/ipvlan_core.c\", \"drivers/net/ipvlan/ipvlan_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.249\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.199\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.122\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.68\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ipvlan/ipvlan.h\", \"drivers/net/ipvlan/ipvlan_core.c\", \"drivers/net/ipvlan/ipvlan_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3c149b662cbb202a450e81f938e702ba333864ad\"}, {\"url\": \"https://git.kernel.org/stable/c/70feb16e3fbfb10b15de1396557c38e99f1ab8df\"}, {\"url\": \"https://git.kernel.org/stable/c/88f83e6c9cdb46b8c8ddd0ba01393362963cf589\"}, {\"url\": \"https://git.kernel.org/stable/c/04ba6de6eff61238e5397c14ac26a6578c7735a5\"}, {\"url\": \"https://git.kernel.org/stable/c/1f300c10d92c547c3a7d978e1212ff52f18256ed\"}, {\"url\": \"https://git.kernel.org/stable/c/6a81e2db096913d7e43aada1c350c1282e76db39\"}, {\"url\": \"https://git.kernel.org/stable/c/d3ba32162488283c0a4c5bedd8817aec91748802\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipvlan: Make the addrs_lock be per port\\n\\nMake the addrs_lock be per port, not per ipvlan dev.\\n\\nInitial code seems to be written in the assumption,\\nthat any address change must occur under RTNL.\\nBut it is not so for the case of IPv6. So\\n\\n1) Introduce per-port addrs_lock.\\n\\n2) It was needed to fix places where it was forgotten\\nto take lock (ipvlan_open/ipvlan_close)\\n\\nThis appears to be a very minor problem though.\\nSince it\u0027s highly unlikely that ipvlan_add_addr() will\\nbe called on 2 CPU simultaneously. But nevertheless,\\nthis could cause:\\n\\n1) False-negative of ipvlan_addr_busy(): one interface\\niterated through all port-\u003eipvlans + ipvlan-\u003eaddrs\\nunder some ipvlan spinlock, and another added IP\\nunder its own lock. Though this is only possible\\nfor IPv6, since looks like only ipvlan_addr6_event() can be\\ncalled without rtnl_lock.\\n\\n2) Race since ipvlan_ht_addr_add(port) is called under\\ndifferent ipvlan-\u003eaddrs_lock locks\\n\\nThis should not affect performance, since add/remove IP\\nis a rare situation and spinlock is not taken on fast\\npaths.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.249\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.199\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.162\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.122\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.68\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.8\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"4.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:20:16.355Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-23103\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T08:44:55.724Z\", \"dateReserved\": \"2026-01-13T15:37:45.966Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-02-04T16:08:24.771Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…