# CVE-2026-23175: linux: In the Linux kernel, the following vulnerability has been resolved:  net: cpsw: Execute ndo_set_rx_mode callback in a...

CVE-2026-23175 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23175 (version 6.18.10-1), released February 14, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-23175
- Priority: High
- CVSS: 7.0 (high)
- EPSS: 0.0013
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  net: cpsw: Execute ndo_set_rx_mode callback in a work queue  Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board:   WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481   RTNL: assertion failed at net/8021q/vlan_core.c (236)   Modules linked in:   CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT   Hardware name: Generic AM33XX (Flattened Device Tree)   Call trace:    unwind_backtrace from show_stack+0x28/0x2c    show_stack from dump_stack_lvl+0x30/0x38    dump_stack_lvl from __warn+0xb8/0x11c    __warn from warn_slowpath_fmt+0x130/0x194    warn_slowpath_fmt from vlan_for_each+0x120/0x124    vlan_for_each from cpsw_add_mc_addr+0x54/0x98    cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec    __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88    __dev_mc_add from igmp6_group_added+0x84/0xec    igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0    __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4    __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168    do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8    ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c    do_sock_setsockopt from __sys_setsockopt+0x84/0xac    __sys_setsockopt from ret_fast_syscall+0x0/0x54  This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.  To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver.  Please note: To reproduce this issue, I manually reverted the changes to am335x-bone-common.dtsi from commit c477358e66a3 ("ARM: dts: am335x-bone: switch to new cpsw switch drv") in order to revert to the legacy cpsw driver.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.18.10-1 | [DEBIAN-CVE-2026-23175](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23175.md) | Feb 14, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.