LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23203: net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue

In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board: WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496 RTNL: assertion failed at net/8021q/vlan_core.c (236) Modules linked in: CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x28/0x2c show_stack from dump_stack_lvl+0x30/0x38 dump_stack_lvl from __warn+0xb8/0x11c __warn from warn_slowpath_fmt+0x130/0x194 warn_slowpath_fmt from vlan_for_each+0x120/0x124 vlan_for_each from cpsw_add_mc_addr+0x54/0xd8 cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88 __dev_mc_add from igmp6_group_added+0x84/0xec igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0 __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4 __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168 do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8 ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c do_sock_setsockopt from __sys_setsockopt+0x84/0xac __sys_setsockopt from ret_fast_syscall+0x0/0x5 This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution. To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the CPSW Ethernet driver. A networking change allowed IPv6 multicast membership handling to reach driver logic without an expected RTNL lock, producing kernel warnings on BeagleBone Black-class hardware. The upstream fix moves processing into a work queue. Business urgency depends on whether you run affected kernel builds on hardware using this driver.

Executive priority

Treat as targeted maintenance unless your fleet includes affected embedded Linux networking devices. There is no sourced exploitation claim or CVSS score, but kernel networking warnings on infrastructure or appliance devices warrant scheduled patch validation.

Technical view

CVE-2026-23203 is a locking-context bug in net/cpsw_new. cpsw_ndo_set_rx_mode can call vlan_for_each, which asserts RTNL is held, after IPv6 multicast joins no longer hold RTNL. The observed result is an RTNL assertion warning. Upstream stable commits change the driver to perform RX mode processing from workqueue context.

Likely exposure

Likely limited to Linux systems using the cpsw_new/CPSW Ethernet driver, such as the BeagleBone Black/AM33XX example in the source. The bundle's affected data includes Linux identifiers 1767bb2d47b7, 6.17, 6.18.10, and 6.19, with no CPEs.

Exploitation context

No active exploitation is reported: KEV is false and no cited source claims exploitation. The source describes a reproducible kernel warning triggered by ordinary IPv6 multicast group joins on one board. The available evidence does not establish remote code execution, privilege escalation, or public exploit availability.

Researcher notes

Key uncertainty is impact. The source shows an RTNL assertion failure path, not a confirmed crash, data exposure, or privilege boundary bypass. Focus analysis on kernels containing commit 1767bb2d47b7, cpsw_new deployments, VLAN interaction, and whether downstream kernels backported the workqueue fix.

Mitigation direction

  • Apply kernel updates that include stable commits d5b3a6698669 or c0b5dc73a38f, where applicable.
  • Review vendor kernel advisories for exact fixed package versions.
  • Prioritize updates on devices using CPSW or cpsw_new Ethernet with IPv6 multicast.
  • If immediate patching is unavailable, monitor vendor guidance; no source-provided workaround is named.

Validation and detection

  • Inventory kernels and hardware for cpsw_new or CPSW driver usage.
  • Confirm deployed kernel source or package includes a referenced stable commit.
  • Review kernel logs for RTNL assertion warnings involving vlan_for_each and cpsw.
  • Check whether IPv6 multicast membership is used on affected embedded Linux systems.
  • Document downstream vendor advisory status where fixed package versions are unclear.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23203 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1767bb2d47b715a106287a8f963d9ec6cbab4e69, 1767bb2d47b715a106287a8f963d9ec6cbab4e69unaffected
LinuxLinux6.17, 0, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.