PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45917 Linux CVE debrief

A race condition in the Linux kernel's IP Virtual Server (IPVS) subsystem can lead to leaked device references when network interfaces are brought down. The vulnerability exists in the interaction between the `ip_vs_dst_event()` netdev notifier and code that caches destination routes (`dest_dst`) with devices that are shutting down. Because the Forwarding Information Base (FIB) may be notified about a closed device after the IPVS handler completes, a valid route can be returned and cached, resulting in a reference to the device being held until the destination is removed. The fix adds a `netif_running()` check to prevent new `dest_dst` attachments when a device is closing, ensuring the notifier handler does not race with device teardown.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux kernels with IPVS enabled for load balancing, particularly cloud providers, hosting providers, and enterprises using Linux Virtual Server (LVS) for high-availability services. Systems with dynamic network interface configuration changes are at elevated risk.

Technical summary

The vulnerability is a race condition in `net/netfilter/ipvs/ip_vs_ctl.c` where `ip_vs_dst_event()` (a netdev notifier) competes with code caching `dest_dst` structures. When a network device is brought down, the FIB notification may arrive after IPVS has processed the down event, allowing a valid route to be cached with a device that is closing. This leaks a reference to the device until the destination is removed. The mitigation adds `netif_running()` checks to prevent attaching new `dest_dst` entries when the device is not running, closing the race window.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor kernel stable releases for backports to affected long-term support (LTS) kernels
  • Review systems using IPVS (IP Virtual Server) for load balancing, particularly those with dynamic network interface changes
  • Consider network namespace isolation to limit blast radius of kernel networking bugs
  • Enable kernel lockdown and secure boot where supported to prevent unauthorized kernel module loading

Evidence notes

CVE published 2026-05-27. NVD status: Awaiting Analysis. No CVSS score assigned. Kernel.org stable branch commits provided as references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45917 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45917

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45917 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45917

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/024eb0bd19f507e6e7f0c7a7e5506d66b5dc1d3e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/64af43033503458c46023e56d6ae7bb0f824b55f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8fde939b0206afc1d5846217a01a16b9bc8c7896

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bae53b3baf2ff2f45f9205c438818fc055601a54

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.