CVE-2023-6200 is a High severity (CVSS 7.5) race condition in the Linux kernel's handling of ICMPv6 router advertisement packets. An adjacent attacker could trigger memory corruption. Red Hat records the upstream fix as landing in kernel 6.7-rc7, so run a kernel that includes it.
What's affected
The record lists the Linux kernel generally, along with the 6.7 release candidates. It does not give a clean version range, so use your vendor's tracker.
- Fixed upstream: Red Hat's tracking bug lists "Fixed In Version: kernel 6.7-rc7".
- Introduced by: Red Hat's statement says the bug came in with an upstream commit titled "net/ipv6: Remove expired routes with a separated list of routes." Kernels without that change are not affected.
- Severity: NVD scores it 7.5 High. Red Hat's tracking bug lists its own priority and severity as high.
Where the sources differ. The NVD description says an unauthenticated attacker on an adjacent network could send a router advertisement and cause arbitrary code execution. Red Hat's statement is narrower on exposure: the attacker must be on the local network over IPv6, and the accept_ra setting for the interface must be enabled. Red Hat says this setting is disabled by default on Red Hat Enterprise Linux, so in its default configuration only local attacks are possible. Other distributions may default differently.
How to check if you're exposed
Start with the kernel version and whether the interface accepts router advertisements.
uname -r
sysctl net.ipv6.conf.all.accept_ra
sysctl net.ipv6.conf.default.accept_ra
cat /proc/sys/net/ipv6/conf/default/accept_ra
A value of 0 means router advertisements are not accepted on that setting, and Red Hat says the remote path is not possible in that case. A value of 1 or 2 means they are. Check per interface too, because the global default can differ from individual interfaces.
Then compare the running kernel with your distribution's security tracker. Distribution kernels carry backports, so a kernel numbered below 6.7 may still contain the fix. Containers share the host kernel, so scanning images will not answer this question. Check the nodes.
What to do now
- Install your distribution's kernel update that references CVE-2023-6200, then reboot into it, or use live patching if your vendor ships it for this fix.
- Where IPv6 autoconfiguration is not needed, set accept_ra to 0 for the relevant interfaces. Red Hat names this as the mitigation.
- Confirm which hosts sit on shared layer 2 networks with untrusted devices, such as guest or lab segments, and prioritize those.
- Consider router advertisement guard features on switches so that only trusted routers can send them.
- Record the kernel version of every node in your inventory so that future kernel advisories can be matched in minutes.
Why it matters
The weakness is CWE-362, a race condition on shared state. Red Hat's description says that when the kernel processes a router advertisement carrying route information with a lifetime, it links the route into a garbage collection list, and a second path that unlinks it on expiry can run at the wrong moment. The two paths do not stay consistent, which leaves the kernel working on memory in an unexpected state.
Router advertisements are unauthenticated by design, and any device on the segment can send one. That is why the mitigation looks like a network setting and not a code change. The kev flag in the record is false, and the sources I retrieved do not report exploitation in the wild. Red Hat's bug title carries a Zero Day Initiative tracking number, which points to a coordinated disclosure.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does disabling accept_ra fully protect me?
Red Hat states the remote attack is not possible when the parameter is disabled. Installing the fixed kernel is still the real remedy.
Which upstream kernel has the fix?
Red Hat lists 6.7-rc7. Distribution kernels may include the fix under older version numbers, so check the vendor tracker.
Sources
Last reviewed: 19 October 2026.
