Cloudanix VulnDB

CVE-2026-98485

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux handles certain IPv6 network rules can let specially made network traffic crash the system.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds memory read in netfilter IPv6 routing extension header match when a rule is configured with zero addresses under non-strict matching, allowing crafted packets to advance an index past the structure boundary and access invalid kernel memory.

Why it matters to the business

Potential kernel crashes or denial of service on systems processing IPv6 traffic with certain netfilter rules, leading to service disruption and requiring emergency reboots or patches; low immediate exploitation risk but high severity for internet-facing or core routing infrastructure.

How an attack unfolds

An attacker sends a specially crafted IPv6 packet containing routing extension header addresses that match a misconfigured ip6t_rt rule with addrnr set to zero; the kernel loop fails to terminate, reads past allocated memory, and triggers a panic or sanitizer alert.

How to fix it

Apply the upstream kernel fix that rejects rules where IP6T_RT_FST_MASK is set but addrnr is zero, and updates the loop termination condition to use i < addrnr in the for-loop header; upgrade to a patched kernel version containing commit resolving CVE-2026-98485.

How to confirm the fix worked

Confirm the patch is present by inspecting rt_mt6_check() and rt_mt6() source for the new zero-addrnr rejection and updated loop condition; test with a rule that would previously have triggered the flaw and verify no out-of-bounds access occurs under KASAN/UBSAN.

Typical attack path

  1. Identify or induce deployment of an ip6t_rt rule requesting address matching with addrnr=0
  2. Craft an IPv6 packet with routing header addresses that satisfy the initial match condition
  3. Send the packet to trigger the unbounded loop and out-of-bounds read in rt_mt6()
  4. Cause kernel panic or memory corruption observable via crash dumps or logs

How to detect it

Review kernel logs for KASAN or UBSAN out-of-bounds warnings referencing ip6t_rt or rt_mt6; examine netfilter rule dumps for any ip6t_rt entries with address matching enabled but zero address count.

What your security team should do

  • Prioritize kernel updates on all systems using netfilter IPv6 rules within the next patch cycle given the memory corruption class
  • Audit existing ip6t_rt rules for any with FST_MASK and zero addresses and correct or remove them
  • Monitor EPSS and KEV status for any increase in exploit maturity over the coming weeks

The record

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read rt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0 even when address matching (IP6T_RT_FST_MASK) is requested. In the IP6T_RT_FST_NSTRICT path, rt_mt6() evaluates packet routing addresses against rtinfo->addrs[i] and terminates backwards at the bottom of the loop: if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) { i++; } if (i == rtinfo->addrnr) break; When addrnr is 0, if the first packet address matches rtinfo->addrs[0], i is incremented to 1. Because i is now strictly greater than addrnr (0), the loop termination condition (i == rtinfo->addrnr) is bypassed and will never be satisfied. If a crafted IPv6 packet contains matching routing addresses, i will advance past IP6T_RT_HOPS (16). The subsequent call to ipv6_addr_equal() reads beyond struct ip6t_rt, triggering UBSAN/KASAN out-of-bounds warnings or kernel panics. Fix this by: 1. Rejecting rules in rt_mt6_check() where IP6T_RT_FST_MASK is set but rtinfo->addrnr is zero. 2. In rt_mt6(), moving the termination condition (i < rtinfo->addrnr) into the for-loop header condition and removing the backwards break at the end of the loop body.

Affected packages

Ecosystem Package Introduced Fixed