{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23175", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.983Z", "datePublished": "2026-02-14T16:27:08.104Z", "dateUpdated": "2026-04-03T13:32:12.340Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-03T13:32:12.340Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cpsw: Execute ndo_set_rx_mode callback in a work queue\n\nCommit 1767bb2d47b7 (\"ipv6: mcast: Don't hold RTNL for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.\") removed the RTNL lock for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this\nchange triggered the following call trace on my BeagleBone Black board:\n WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481\n RTNL: assertion failed at net/8021q/vlan_core.c (236)\n Modules linked in:\n CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT\n Hardware name: Generic AM33XX (Flattened Device Tree)\n Call trace:\n unwind_backtrace from show_stack+0x28/0x2c\n show_stack from dump_stack_lvl+0x30/0x38\n dump_stack_lvl from __warn+0xb8/0x11c\n __warn from warn_slowpath_fmt+0x130/0x194\n warn_slowpath_fmt from vlan_for_each+0x120/0x124\n vlan_for_each from cpsw_add_mc_addr+0x54/0x98\n cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec\n __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88\n __dev_mc_add from igmp6_group_added+0x84/0xec\n igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0\n __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4\n __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168\n do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8\n ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c\n do_sock_setsockopt from __sys_setsockopt+0x84/0xac\n __sys_setsockopt from ret_fast_syscall+0x0/0x54\n\nThis trace occurs because vlan_for_each() is called within\ncpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.\nSince modifying vlan_for_each() to operate without the RTNL lock is not\nstraightforward, and because ndo_set_rx_mode() is invoked both with and\nwithout the RTNL lock across different code paths, simply adding\nrtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.\n\nTo resolve this issue, we opt to execute the actual processing within\na work queue, following the approach used by the icssg-prueth driver.\n\nPlease note: To reproduce this issue, I manually reverted the changes to\nam335x-bone-common.dtsi from commit c477358e66a3 (\"ARM: dts: am335x-bone:\nswitch to new cpsw switch drv\") in order to revert to the legacy cpsw\ndriver."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/ti/cpsw.c"], "versions": [{"version": "1767bb2d47b715a106287a8f963d9ec6cbab4e69", "lessThan": "488009aa62bb1217ea0624fd5108b79adef4e148", "status": "affected", "versionType": "git"}, {"version": "1767bb2d47b715a106287a8f963d9ec6cbab4e69", "lessThan": "0b8c878d117319f2be34c8391a77e0f4d5c94d79", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/ti/cpsw.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.10", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/488009aa62bb1217ea0624fd5108b79adef4e148"}, {"url": "https://git.kernel.org/stable/c/0b8c878d117319f2be34c8391a77e0f4d5c94d79"}], "title": "net: cpsw: Execute ndo_set_rx_mode callback in a work queue", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cpsw: Execute ndo_set_rx_mode callback in a work queue\n\nCommit 1767bb2d47b7 (\"ipv6: mcast: Don't hold RTNL for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.\") removed the RTNL lock for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this\nchange triggered the following call trace on my BeagleBone Black board:\n WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481\n RTNL: assertion failed at net/8021q/vlan_core.c (236)\n Modules linked in:\n CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT\n Hardware name: Generic AM33XX (Flattened Device Tree)\n Call trace:\n unwind_backtrace from show_stack+0x28/0x2c\n show_stack from dump_stack_lvl+0x30/0x38\n dump_stack_lvl from __warn+0xb8/0x11c\n __warn from warn_slowpath_fmt+0x130/0x194\n warn_slowpath_fmt from vlan_for_each+0x120/0x124\n vlan_for_each from cpsw_add_mc_addr+0x54/0x98\n cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec\n __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88\n __dev_mc_add from igmp6_group_added+0x84/0xec\n igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0\n __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4\n __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168\n do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8\n ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c\n do_sock_setsockopt from __sys_setsockopt+0x84/0xac\n __sys_setsockopt from ret_fast_syscall+0x0/0x54\n\nThis trace occurs because vlan_for_each() is called within\ncpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.\nSince modifying vlan_for_each() to operate without the RTNL lock is not\nstraightforward, and because ndo_set_rx_mode() is invoked both with and\nwithout the RTNL lock across different code paths, simply adding\nrtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.\n\nTo resolve this issue, we opt to execute the actual processing within\na work queue, following the approach used by the icssg-prueth driver.\n\nPlease note: To reproduce this issue, I manually reverted the changes to\nam335x-bone-common.dtsi from commit c477358e66a3 (\"ARM: dts: am335x-bone:\nswitch to new cpsw switch drv\") in order to revert to the legacy cpsw\ndriver."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: cpsw: Ejecutar la devoluci\u00f3n de llamada ndo_set_rx_mode en una cola de trabajo\n\nEl commit 1767bb2d47b7 ('ipv6: mcast: No retener RTNL para IPV6_ADD_MEMBERSHIP y MCAST_JOIN_GROUP.') elimin\u00f3 el bloqueo RTNL para las operaciones IPV6_ADD_MEMBERSHIP y MCAST_JOIN_GROUP. Sin embargo, este cambio desencaden\u00f3 el siguiente rastreo de llamadas en mi placa BeagleBone Black:\n WARNING: net/8021q/vlan_core.c:236 en vlan_for_each+0x120/0x124, CPU#0: rpcbind/481\n RTNL: aserci\u00f3n fallida en net/8021q/vlan_core.c (236)\n M\u00f3dulos enlazados:\n CPU: 0 UID: 997 PID: 481 Comm: rpcbind No contaminado 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT\n Nombre del hardware: Generic AM33XX (Flattened Device Tree)\n Rastreo de llamadas:\n unwind_backtrace desde show_stack+0x28/0x2c\n show_stack desde dump_stack_lvl+0x30/0x38\n dump_stack_lvl desde __warn+0xb8/0x11c\n __warn desde warn_slowpath_fmt+0x130/0x194\n warn_slowpath_fmt desde vlan_for_each+0x120/0x124\n vlan_for_each desde cpsw_add_mc_addr+0x54/0x98\n cpsw_add_mc_addr desde __hw_addr_ref_sync_dev+0xc4/0xec\n __hw_addr_ref_sync_dev desde __dev_mc_add+0x78/0x88\n __dev_mc_add desde igmp6_group_added+0x84/0xec\n igmp6_group_added desde __ipv6_dev_mc_inc+0x1fc/0x2f0\n __ipv6_dev_mc_inc desde __ipv6_sock_mc_join+0x124/0x1b4\n __ipv6_sock_mc_join desde do_ipv6_setsockopt+0x84c/0x1168\n do_ipv6_setsockopt desde ipv6_setsockopt+0x88/0xc8\n ipv6_setsockopt desde do_sock_setsockopt+0xe8/0x19c\n do_sock_setsockopt desde __sys_setsockopt+0x84/0xac\n __sys_setsockopt desde ret_fast_syscall+0x0/0x54\n\nEste rastreo ocurre porque se llama a vlan_for_each() dentro de cpsw_ndo_set_rx_mode(), que espera que el bloqueo RTNL est\u00e9 retenido. Dado que modificar vlan_for_each() para operar sin el bloqueo RTNL no es sencillo, y debido a que ndo_set_rx_mode() se invoca tanto con como sin el bloqueo RTNL a trav\u00e9s de diferentes rutas de c\u00f3digo, simplemente a\u00f1adir rtnl_lock() en cpsw_ndo_set_rx_mode() no es una soluci\u00f3n viable.\n\nPara resolver este problema, optamos por ejecutar el procesamiento real dentro de una cola de trabajo, siguiendo el enfoque utilizado por el controlador icssg-prueth.\n\nTenga en cuenta: Para reproducir este problema, revert\u00ed manualmente los cambios en am335x-bone-common.dtsi del commit c477358e66a3 ('ARM: dts: am335x-bone: cambiar a nuevo controlador de switch cpsw') para revertir al controlador cpsw heredado."}], "id": "CVE-2026-23175", "lastModified": "2026-04-03T14:16:25.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-02-14T17:15:55.210", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b8c878d117319f2be34c8391a77e0f4d5c94d79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/488009aa62bb1217ea0624fd5108b79adef4e148"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: net: cpsw: Execute ndo_set_rx_mode callback in a work queue", "id": "2439946", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439946"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: cpsw: Execute ndo_set_rx_mode callback in a work queue\nCommit 1767bb2d47b7 (\"ipv6: mcast: Don't hold RTNL for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.\") removed the RTNL lock for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this\nchange triggered the following call trace on my BeagleBone Black board:\nWARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481\nRTNL: assertion failed at net/8021q/vlan_core.c (236)\nModules linked in:\nCPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT\nHardware name: Generic AM33XX (Flattened Device Tree)\nCall trace:\nunwind_backtrace from show_stack+0x28/0x2c\nshow_stack from dump_stack_lvl+0x30/0x38\ndump_stack_lvl from __warn+0xb8/0x11c\n__warn from warn_slowpath_fmt+0x130/0x194\nwarn_slowpath_fmt from vlan_for_each+0x120/0x124\nvlan_for_each from cpsw_add_mc_addr+0x54/0x98\ncpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec\n__hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88\n__dev_mc_add from igmp6_group_added+0x84/0xec\nigmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0\n__ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4\n__ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168\ndo_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8\nipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c\ndo_sock_setsockopt from __sys_setsockopt+0x84/0xac\n__sys_setsockopt from ret_fast_syscall+0x0/0x54\nThis trace occurs because vlan_for_each() is called within\ncpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.\nSince modifying vlan_for_each() to operate without the RTNL lock is not\nstraightforward, and because ndo_set_rx_mode() is invoked both with and\nwithout the RTNL lock across different code paths, simply adding\nrtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.\nTo resolve this issue, we opt to execute the actual processing within\na work queue, following the approach used by the icssg-prueth driver.\nPlease note: To reproduce this issue, I manually reverted the changes to\nam335x-bone-common.dtsi from commit c477358e66a3 (\"ARM: dts: am335x-bone:\nswitch to new cpsw switch drv\") in order to revert to the legacy cpsw\ndriver."], "name": "CVE-2026-23175", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23175\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23175\nhttps://lore.kernel.org/linux-cve-announce/2026021427-CVE-2026-23175-8c89@gregkh/T"]}

{"created": "2026-02-16T09:44:03.536358+00:00", "updated": "2026-02-16T09:44:03.536462+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}