Cloudanix VulnDB

CVE-2026-99121

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's network routing code can make systems crash when handling certain network path changes.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ipv4 fib_rebalance() allows concurrent ignore_routes_with_linkdown change to produce zero total nexthop weight on first pass while eligible nexthops exist on second pass, resulting in divide-by-zero.

Why it matters to the business

Unexpected kernel crashes or panics on Linux systems performing IPv4 multipath routing can cause network outages, service disruption, and require reboots or failovers.

How an attack unfolds

An attacker with sufficient privileges to alter routing configuration or link states concurrently triggers the two-pass rebalance logic so the first pass sees zero weight while the second pass encounters an eligible nexthop, forcing a divide-by-zero fault.

How to fix it

Apply the upstream kernel fix that checks for zero total weight and sets upper bounds to -1 to skip division; upgrade to a maintained kernel branch containing commit equivalent to the referenced IPv6 fix.

How to confirm the fix worked

Verify kernel source contains the zero-total-weight guard in fib_rebalance(); confirm no divide-by-zero oops in routing stress tests after update.

Typical attack path

  1. Obtain privileges to modify IPv4 routes or interface link-down settings
  2. Induce concurrent changes to ignore_routes_with_linkdown during fib_rebalance execution
  3. Force first pass to compute zero total weight while second pass sees eligible nexthop
  4. Trigger kernel divide-by-zero fault and resulting panic

How to detect it

Search kernel logs and dmesg for divide-by-zero faults or oops mentioning fib_rebalance; correlate with routing daemon activity or interface link events around crash timestamps.

  • divide by zero in fib_rebalance
  • fib_rebalance.*oops
  • rt6_multipath_rebalance reference in panic

What your security team should do

  • Prioritize kernel updates on all systems performing IPv4 multipath routing
  • Monitor vendor advisories for backported fixes in distribution kernels
  • Test routing failover and multipath configurations under link-down events post-update

The record

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_routes_with_linkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero. If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6_multipath_rebalance") and preserves the lock-free rebalance path.

Affected packages

Ecosystem Package Introduced Fixed