Cloudanix VulnDB

CVE-2026-23124

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Feb 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how network discovery messages are processed could let someone with local access disrupt IPv6 network connections on affected systems.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
None

What it actually does

Data race in ndisc_router_discovery allowing unsynchronized concurrent read and write access to in6_dev->ra_mtu, potentially resulting in inconsistent or invalid IPv6 MTU values.

Why it matters to the business

May lead to network instability or denial of service affecting IPv6 connectivity in environments using affected Linux kernel components, with high prevalence across OpenSearch ecosystem packages increasing exposure surface.

How an attack unfolds

An attacker with local access sends crafted ICMPv6 router advertisement packets that trigger concurrent invocations of ndisc_router_discovery, exploiting the missing synchronization to corrupt ra_mtu state.

How to fix it

Upgrade all affected OpenSearch packages to version 3.3.2-r0 or later; apply kernel patches that introduce READ_ONCE/WRITE_ONCE annotations around ra_mtu accesses.

How to confirm the fix worked

Verify presence of READ_ONCE/WRITE_ONCE macros in ndisc_router_discovery and confirm no KCSAN data-race reports on ra_mtu after upgrade; test with concurrent IPv6 router advertisement traffic.

Typical attack path

  1. Obtain local code execution or user access on target system
  2. Craft and transmit ICMPv6 packets to invoke ndisc_rcv path
  3. Trigger parallel router discovery processing to hit the data race
  4. Observe or induce MTU-related network failures

How to detect it

Search kernel logs and KCSAN output for data-race reports involving ndisc_router_discovery and in6_dev ra_mtu accesses; inspect network packet captures for anomalous ICMPv6 router advertisements coinciding with MTU changes.

  • BUG: KCSAN: data-race in ndisc_router_discovery
  • ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558
  • read to 0xffff888119809c20 of 4 bytes
  • write to 0xffff888119809c20 of 4 bytes

What your security team should do

  • Prioritize patching OpenSearch packages to 3.3.2-r0 within standard maintenance windows due to broad ecosystem prevalence
  • Monitor kernel logs for KCSAN warnings related to IPv6 neighbor discovery
  • Restrict untrusted local code execution where feasible until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: ipv6: annotate data-race in ndisc_router_discovery() syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1] This looks fine, IFLA_INET6_RA_MTU is best effort. Add READ_ONCE()/WRITE_ONCE() to document the race. Note that we might also reject illegal MTU values (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch. [1] BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1: ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0: ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... value changed: 0x00000000 -> 0xe5400659

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.15.0 5.15.199

Related vulnerabilities