PT-2026-61286 · Linux · Linux

CVE-2026-63969 · Published 2026-07-19 · Updated 2026-07-19

NVD

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible infinite loop in rt6 fill node()

Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6 info uses dev()").

Writers holding tb6 lock can list del rcu(&rt->fib6 siblings) without waiting for RCU readers; rt->fib6 siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6 siblings, causing a CPU stall. fib6 del route() always WRITE ONCE()s rt->fib6 nsiblings to 0 before list del rcu(), so an inside-loop check is a reliable detach signal.

[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev

Related Identifiers

CVE-2026-63969

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63969 · Security Note
• https://git.kernel.org/stable/c/9f72412bcf60144f252b0d6205106abf14344abc · Note
• https://git.kernel.org/stable/c/5e40de719ee76b8d96e2556ce36dbd3bd07bf37d · Note
• https://git.kernel.org/stable/c/279853aec9f58d5cd723e6e5617c1c3337b30383 · Note
• https://git.kernel.org/stable/c/dc36a04621dcc2447dae428709207810b6c06e14 · Note
• https://git.kernel.org/stable/c/b014a63d2f2c2c767762b548381882dfb1655529 · Note
• https://git.kernel.org/stable/c/c65b1f60237daac7c56c2652e064cc566a45dc81 · Note