CVE-2026-98598
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A Linux kernel bug can make network interfaces get stuck when being removed, potentially disrupting network operations until the system is restarted.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in IPv6 route exception handling allows rt6_insert_exception to succeed against a dying fib6_info, creating a reference cycle that leaks fib6_info structures, nexthop devices, and per-CPU routes, ultimately stalling netdevice unregistration.
Why it matters to the business
Network interface removal or system shutdown can hang indefinitely, causing prolonged outages for services relying on dynamic network configuration or container teardown; low exploitability reduces immediate risk but still requires prompt patching on affected kernels.
How an attack unfolds
An attacker with local network configuration privileges concurrently triggers IPv6 route insertions while routes are being purged, exploiting the window where the flush bit is not yet set to create a cyclic reference and leak kernel memory.
How to fix it
Update to a Linux kernel containing the fix that calls fib6_drop_pcpu_from before rt6_flush_exceptions and checks fib6_destroying in rt6_insert_exception; apply the patch series that removes the dead FIB6_EXCEPTION_BUCKET_FLUSHED logic.
How to confirm the fix worked
Confirm the kernel version includes the cited commit, then exercise netdevice registration and IPv6 route insertion/removal under concurrent load while monitoring for unregister_netdevice stalls or reference count leaks.
Typical attack path
- Obtain local access or capability to modify IPv6 routing tables
- Trigger concurrent route addition and route purge operations on the same fib6_info
- Cause fib6_purge_rt to run while rt6_insert_exception succeeds without the destroying flag check
- Observe netdevice unregistration stall due to leaked references
How to detect it
Search kernel logs for repeated unregister_netdevice waiting messages referencing IPv6 interfaces; inspect for elevated reference counts on fib6_info or gre6 devices during shutdown or interface teardown.
What your security team should do
- Prioritize kernel updates on systems performing frequent IPv6 route changes or container networking
- Monitor for netdevice unregistration warnings in dmesg on production hosts
- Test patched kernels in staging environments that reproduce high-frequency route churn
The record
In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6_insert_exception() for dying fib6_info. Before the cited commit, fib6_nh_flush_exceptions() always set from->exception_bucket_flushed = 1 under rt6_exception_lock to prevent rt6_insert_exception() from inserting a new exception for a dying fib6_info. The flag was replaced with the FIB6_EXCEPTION_BUCKET_FLUSHED bit stored in nh->rt6i_exception_bucket. The problem is that now the bit is only set when the bucket is not NULL and fib6_nh_flush_exceptions() is called from fib6_nh_release() after fib6_ref has already reached zero. If rt6_insert_exception() is called while the target fib6_info is being removed via fib6_purge_rt(), a new exception could be created successfully because rt6_flush_exceptions() no longer sets the bit. This creates a reference cycle between the fib6_info and the exception route, leaking the fib6_info, its nexthop device, and all per-CPU routes in fib6_nh->rt6i_pcpu, which stalls netdev unregistration. [ 34.680602] unregister_netdevice: waiting for gre6 to become free. Usage count = 68 [ 44.920675] unregister_netdevice: waiting for gre6 to become free. Usage count = 68 [ 55.176582] unregister_netdevice: waiting for gre6 to become free. Usage count = 68 Let's call fib6_drop_pcpu_from() before rt6_flush_exceptions(), to set fib6_destroying before rt6_exception_lock, and check f6i->fib6_destroying in rt6_insert_exception(). Note that FIB6_EXCEPTION_BUCKET_FLUSHED logic is dead and we can clean it up in net-next.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|