Executive brief
A vulnerability in the Linux kernel's networking component could allow a remote attacker to cause a system hang or crash. The issue occurs when the system processes specific IPv6 network traffic, leading to an infinite loop that consumes all available processing power. This can result in a complete denial of service for the affected server or device.
Technical details
A race condition exists in the Linux kernel's IPv6 routing table (FIB) management. Specifically, in fib6_select_path(), a softirq-side walker can enter an infinite loop if a writer holding the tb6_lock removes a sibling route (list_del_rcu) without waiting for RCU readers. Because the 'next' pointer of the deleted element still points back into the old circular list, the walker may never reach the expected terminator. This occurs under high next-hop churn. The fix introduces a check for fib6_nsiblings using READ_ONCE() inside the loop to detect when a route has been detached. Patches have been backported to several stable kernel branches including 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux 6.1.128 to 6.1.176, 6.6.75 to 6.6.143, 6.12.2 to 6.12.93, 6.13
Timeline
- 2026-05-27: disclosed: Initial patch submitted by Jiayuan Chen
- 2026-05-29: patched: Mainline kernel patch committed
- 2026-07-19: advisory: CVE-2026-63968 published
References
- https://git.kernel.org/stable/c/0f7b73c3452635de83b8711b31abdda8e49aad7b
- https://git.kernel.org/stable/c/3948a7d92f7678e89e1776bb2d169afcad63b1ae
- https://git.kernel.org/stable/c/9b9d5bd6e3d4c9cecab5407604b690684b2532d2
- https://git.kernel.org/stable/c/9c7da87c2dc860bb17ca1ece942495d28b1ce3b9
- https://git.kernel.org/stable/c/ab9a10969a907b472a0196d999c08ff7144172e3
- https://git.kernel.org/stable/c/c87cd3cb309634bc8f50a54e2079424f219ac21f