CVE-2026-93226

ipv6: use RCU iterator to dump route exceptions

Published Sep 24, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU iterator to dump route exceptions

rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
RCU-protected exception lists. The caller holds rcu_read_lock(), but does
not hold rt6_exception_lock, so rt6_insert_exception() can concurrently
add an entry with hlist_add_head_rcu().

KCSAN reports this race (irrelevant details omitted):

==================================================================
BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions

write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:
rt6_insert_exception+0x3bb/0x760
__ip6_rt_update_pmtu+0x4fe/0x750
ip6_sk_update_pmtu+0x19a/0x3b0
udpv6_err+0x3ff/0x800
icmpv6_notify+0x1e1/0x440
icmpv6_rcv+0x8c0/0xab0
ip6_protocol_deliver_rcu+0x616/0x840
ip6_input_finish+0xb9/0x160
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:
rt6_nh_dump_exceptions+0xb3/0x260
rt6_dump_route+0x53e/0x5f0
fib6_dump_node+0x6d/0xf0
fib6_walk_continue+0x290/0x2d0
fib6_dump_table+0x28d/0x360
inet6_dump_fib+0x37d/0x620
rtnl_dumpit+0x7b/0xd0
netlink_dump+0x3ae/0x7e0
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f

4 locks held by dumper/549:
...
#1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620
#2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360
#3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0

value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100

Reported by Kernel Concurrency Sanitizer on:
CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted
7.2.0-rc7-virtme #38 PREEMPT(lazy)
...

Use hlist_for_each_entry_rcu() to safely iterate over the exception list.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< dffbfb3117138e8e0e09d05f507bd36ca1f696e5
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< 6bd3f94ed858f2d072627546b4cdf712b0f8ea88
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< 9c6be625e1a7258e845d6193b3b6b084a00f8e9e
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< 3665abc3d2ae8a78cb67f858e848481432ec75db
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< eda56ee17713f9dd834b922f7dbfa2e25fa6358c
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< a602cd128d17a793e12888edc8eda85821ede7e1
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< f6b1b15848fd91fe122dac0d19d3d666e35075b6
`1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9`	affected	< 47cdab0d51aaa9bd85f8e4904585bd5bd4df4488

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,dffbfb3117138e8e0e09d05f507bd36ca1f696e5)`	affected	code_commit	—
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,6bd3f94ed858f2d072627546b4cdf712b0f8ea88)`	affected	code_commit	—
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,9c6be625e1a7258e845d6193b3b6b084a00f8e9e)`	affected	code_commit	—
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,3665abc3d2ae8a78cb67f858e848481432ec75db)`	affected	code_commit	—
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,eda56ee17713f9dd834b922f7dbfa2e25fa6358c)`	affected	code_commit	—
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,a602cd128d17a793e12888edc8eda85821ede7e1)`	affected	code_commit	—
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,f6b1b15848fd91fe122dac0d19d3d666e35075b6)`	affected	code_commit	—
`[1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9,47cdab0d51aaa9bd85f8e4904585bd5bd4df4488)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.177% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3665abc3d2ae8a78cb67f858e848481432ec75db
https://git.kernel.org/stable/c/47cdab0d51aaa9bd85f8e4904585bd5bd4df4488
https://git.kernel.org/stable/c/6bd3f94ed858f2d072627546b4cdf712b0f8ea88
https://git.kernel.org/stable/c/9c6be625e1a7258e845d6193b3b6b084a00f8e9e
https://git.kernel.org/stable/c/a602cd128d17a793e12888edc8eda85821ede7e1
https://git.kernel.org/stable/c/dffbfb3117138e8e0e09d05f507bd36ca1f696e5
https://git.kernel.org/stable/c/eda56ee17713f9dd834b922f7dbfa2e25fa6358c
https://git.kernel.org/stable/c/f6b1b15848fd91fe122dac0d19d3d666e35075b6

History

Sep 25, 2026 11:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sep 24, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over RCU-protected exception lists. The caller holds rcu_read_lock(), but does not hold rt6_exception_lock, so rt6_insert_exception() can concurrently add an entry with hlist_add_head_rcu(). KCSAN reports this race (irrelevant details omitted): ================================================================== BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5: rt6_insert_exception+0x3bb/0x760 __ip6_rt_update_pmtu+0x4fe/0x750 ip6_sk_update_pmtu+0x19a/0x3b0 udpv6_err+0x3ff/0x800 icmpv6_notify+0x1e1/0x440 icmpv6_rcv+0x8c0/0xab0 ip6_protocol_deliver_rcu+0x616/0x840 ip6_input_finish+0xb9/0x160 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14: rt6_nh_dump_exceptions+0xb3/0x260 rt6_dump_route+0x53e/0x5f0 fib6_dump_node+0x6d/0xf0 fib6_walk_continue+0x290/0x2d0 fib6_dump_table+0x28d/0x360 inet6_dump_fib+0x37d/0x620 rtnl_dumpit+0x7b/0xd0 netlink_dump+0x3ae/0x7e0 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f 4 locks held by dumper/549: ... #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620 #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360 #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0 value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100 Reported by Kernel Concurrency Sanitizer on: CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted 7.2.0-rc7-virtme #38 PREEMPT(lazy) ... Use hlist_for_each_entry_rcu() to safely iterate over the exception list.
Title		ipv6: use RCU iterator to dump route exceptions
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3665abc3d2ae8a78cb67f858e848481432ec75db https://git.kernel.org/stable/c/47cdab0d51aaa9bd85f8e4904585bd5bd4df4488 https://git.kernel.org/stable/c/6bd3f94ed858f2d072627546b4cdf712b0f8ea88 https://git.kernel.org/stable/c/9c6be625e1a7258e845d6193b3b6b084a00f8e9e https://git.kernel.org/stable/c/a602cd128d17a793e12888edc8eda85821ede7e1 https://git.kernel.org/stable/c/dffbfb3117138e8e0e09d05f507bd36ca1f696e5 https://git.kernel.org/stable/c/eda56ee17713f9dd834b922f7dbfa2e25fa6358c https://git.kernel.org/stable/c/f6b1b15848fd91fe122dac0d19d3d666e35075b6