CVE-2023-26545: Linux Kernel Use-After-Free Vulnerability

CVE-2023-26545 Overview

CVE-2023-26545 is a double free vulnerability in the Linux kernel's MPLS (Multiprotocol Label Switching) subsystem. The flaw resides in net/mpls/af_mpls.c and triggers when an allocation failure occurs while registering the sysctl table under a new location during a network device rename. The bug affects Linux kernel versions before 6.1.13 and impacts downstream products including Debian Linux and several NetApp HCI storage and compute platforms. The weakness is classified under CWE-415 (Double Free).

Critical Impact
A local attacker with the ability to rename MPLS-enabled network interfaces can trigger a double free, leading to kernel memory corruption and a denial-of-service condition on the affected host.

Affected Products

Linux kernel versions prior to 6.1.13
Debian Linux 10 (with affected kernel packages)
NetApp HCI H300S, H500S, H700S, H410S, and H410C firmware

Discovery Timeline

2023-02-25 - CVE-2023-26545 published to the National Vulnerability Database
2023-03-16 - NetApp publishes security advisory ntap-20230316-0009
2023-05 - Debian LTS publishes advisories addressing the kernel flaw
2025-06-25 - Last updated in NVD database

Technical Details for CVE-2023-26545

Vulnerability Analysis

The vulnerability lives in the MPLS networking code at net/mpls/af_mpls.c. When a network device is renamed, the kernel must re-register the per-device sysctl table at a new path that reflects the updated interface name. If the allocation that backs this re-registration fails, the error handling path frees a memory region that is also freed elsewhere on the same code path, producing a double free.

Double free conditions in kernel memory allocators corrupt slab metadata. Subsequent allocations from the same slab cache can return overlapping objects, which destabilizes the kernel and may be leveraged for further memory corruption primitives. The fix is delivered in upstream commit fda6c89fe3d9, which corrects the cleanup logic so the buffer is released exactly once.

Root Cause

The root cause is improper error-path handling in the MPLS sysctl re-registration routine invoked during the NETDEV_CHANGENAME notifier. When register_net_sysctl fails due to memory pressure, the cleanup logic frees a structure that the caller will also free, violating single-ownership semantics for kernel heap allocations.

Attack Vector

Exploitation requires local access and the ability to rename network devices, which typically requires CAP_NET_ADMIN within a user or network namespace. An attacker triggers repeated device renames on an MPLS-configured interface while inducing memory allocation pressure to force the failure path. The resulting double free corrupts the SLUB allocator and crashes the kernel.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream commit for the technical fix details.

Detection Methods for CVE-2023-26545

Indicators of Compromise

Unexpected kernel panics or BUG: KASAN: double-free messages referencing net/mpls/af_mpls.c in dmesg or /var/log/kern.log.
Repeated ip link set <iface> name <newname> operations against MPLS-enabled interfaces from non-administrative users or containers.
Sudden host reboots or kernel oopses on systems with the mpls_router module loaded.

Detection Strategies

Inventory Linux endpoints to identify kernels older than 6.1.13 and flag those with the mpls_router kernel module loaded.
Enable kernel address sanitizer (KASAN) builds in test environments to surface double-free conditions during fuzzing of netlink interface operations.
Audit namespaces and containers that grant CAP_NET_ADMIN, as these enable the renaming primitive required for exploitation.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log platform and alert on double free, slab-use-after-free, or general protection fault strings tied to MPLS symbols.
Monitor auditd for SYSCALL events involving rtnetlink device rename operations originating from unexpected UIDs.
Track loaded kernel modules and alert when mpls_router is loaded on systems that do not require MPLS forwarding.

How to Mitigate CVE-2023-26545

Immediate Actions Required

Upgrade affected systems to Linux kernel 6.1.13 or later, or apply the distribution backport that includes commit fda6c89fe3d9.
For Debian systems, apply the kernel updates referenced in Debian LTS announcement 00005 and 00006.
For NetApp HCI platforms, follow the remediation guidance in NetApp advisory ntap-20230316-0009.
Restrict CAP_NET_ADMIN in untrusted user namespaces and container runtimes until patches are deployed.

Patch Information

The upstream fix is included in the Linux 6.1.13 ChangeLog and applied via commit fda6c89fe3d9aca073495a664e1d5aea28cd4377. Vendor-specific patched packages are available from Debian and NetApp through the advisories listed above.

Workarounds

Unload and blacklist the mpls_router module on hosts that do not require MPLS, eliminating the vulnerable code path.
Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 on distributions that support this toggle to remove the renaming primitive.
Limit interface management to administrative users and avoid granting CAP_NET_ADMIN to general-purpose containers.

bash

# Verify kernel version and disable the MPLS module on hosts that do not need it
uname -r
lsmod | grep mpls_router
echo "blacklist mpls_router" | sudo tee /etc/modprobe.d/blacklist-mpls.conf
sudo rmmod mpls_router 2>/dev/null || true

# Restrict unprivileged user namespaces (Debian/Ubuntu)
echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system