CVE-2026-98596

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug can slowly leak memory when network devices are added or removed under certain IPv6 conditions, which may eventually affect system stability.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: Moderate
Impact: Denial Of Service
Component: OS kernel
Class: Race Condition
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Race condition in IPv6 uncached route handling allows concurrent list_del_init during device unregistration to make list_empty true, causing ip6_route_output_flags to incorrectly call dst_hold_safe and ip6_rt_put_flags to skip ip6_rt_put, leaking dst references and tied device references.

Why it matters to the business

Gradual kernel memory exhaustion and potential device reference leaks in IPv6 environments with dynamic network devices, risking system instability or crashes; low urgency given absence from known exploitation lists and stable low exploit probability.

How an attack unfolds

An attacker triggers IPv6 route output operations while a network device is unregistered, racing against rt6_uncached_list_flush_dev to hit the list_empty check after list_del_init, leaking dst entries; the partial prior fix is bypassed by checking the wrong list field.

How to fix it

Apply the upstream kernel patch that replaces the list_empty check on rt->dst.rt_uncached with a check on rt6->dst.rt_uncached_list in ip6_route_output_flags, ip6_rt_put_flags, and ip6_dst_check; update to a fixed kernel version containing commit references to 9a6f0c4d5796 and the new check.

How to confirm the fix worked

Inspect kernel source for the corrected rt6->dst.rt_uncached_list check in the listed functions and confirm absence of the prior list_empty(&rt->dst.rt_uncached) pattern; test device unregistration under concurrent IPv6 route output load for zero leaks.

Typical attack path

Perform IPv6 route lookups via ip6_route_output_flags on a device
Concurrently unregister the network device to invoke rt6_uncached_list_flush_dev
Exploit timing of list_del_init versus list_empty check to skip put operations
Accumulate leaked dst and device references over repeated races

How to detect it

Search kernel logs and slab allocator statistics for repeated dst or IPv6 route allocation growth without corresponding frees during device hotplug events; correlate with rt6_uncached_list operations but no specific post-exploitation artifacts are observable.

What your security team should do

Prioritize kernel updates for systems with heavy IPv6 usage and dynamic interfaces
Monitor upstream stable branches for backports of the uncached list race fix
Review IPv4-only environments for lower exposure as they lack the equivalent issue

The record

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check() detect an uncached route by list_empty(&rt->dst.rt_uncached), which replaced the static DST_NOCACHE flag check in commit a4c2fd7f7891 ("net: remove DST_NOCACHE flag"). When a device is unregistered, rt6_uncached_list_flush_dev() unlinks uncached routes tied to the device from rt6_uncached_list. Previously, they were moved to another list with list_move() (__list_del_entry() + list_add()), and since commit 98aa546af5e4 ("inet: remove (struct uncached_list)->quarantine"), the routes are just unlinked with list_del_init(). If list_del_init() runs concurrently, list_empty() evaluates to true; ip6_route_output_flags() calls dst_hold_safe() incorrectly and ip6_rt_put_flags() skips ip6_rt_put(), leaking dst, and thus dev tied via rt->from as well. The same race is partially fixed by commit 9a6f0c4d5796 ("dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()"). Let's check rt6->dst.rt_uncached_list instead. Note that IPv4 does not have the same issue.

Affected packages

Ecosystem	Package	Introduced	Fixed