CVE-2026-45917 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not keep dest_dst if dev is going down There is race between the netdev notifier ip_vs_dst_event() and the code that caches dst with dev that is going down. As the FIB can be notified for the closed device after our handler finishes, it is possible valid route to be returned and cached resuling in a leaked dev reference until the dest is not removed. To prevent new dest_dst to be attached to dest just after the handler dropped the old one, add a netif_running() check to make sure the notifier handler is not currently running for device that is closing.
A race condition vulnerability has been identified in the Linux kernel's IP Virtual Server (IPVS) component. This issue arises when the netdev notifier 'ip_vs_dst_event()' interacts with the destination caching mechanism for network devices that are shutting down. As a result, a valid route can be incorrectly cached, leading to a leaked device reference until the destination is explicitly removed. To address this, a check has been added to ensure that the notifier handler is not processing a closing device before allowing new destination references to be attached.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for upgrading the Linux kernel can be found in the official Linux documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/024eb0bd19f507e6e7f0c7a7e5506d66b5dc1d3e | kernel.org | Patch |
| https://git.kernel.org/stable/c/64af43033503458c46023e56d6ae7bb0f824b55f | kernel.org | Patch |
| https://git.kernel.org/stable/c/8fde939b0206afc1d5846217a01a16b9bc8c7896 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bae53b3baf2ff2f45f9205c438818fc055601a54 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.39.1, < 6.12.75 >= 6.13, < 6.18.14 >= 6.19, < 6.19.4 2.6.39 - |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |