CVE-2026-23209

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

macvlan: fix error recovery in macvlan_common_newlink()

valis provided a nice repro to crash the kernel:

ip link add p1 type veth peer p2

ip link set address 00:00:00:00:00:20 dev p1

ip link set up dev p1

ip link set up dev p2

ip link add mv0 link p2 type macvlan mode source

ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20

ping -c1 -I p1 1.2.3.4

He also gave a very detailed analysis:

<quote valis>

The issue is triggered when a new macvlan link is created with

MACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or

MACVLAN_MACADDR_SET) parameter, lower device already has a macvlan

port and register_netdevice() called from macvlan_common_newlink()

fails (e.g. because of the invalid link name).

In this case macvlan_hash_add_source is called from

macvlan_change_sources() / macvlan_common_newlink():

This adds a reference to vlan to the port's vlan_source_hash using

macvlan_source_e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References