Executive brief
The Linux kernel's IPv6 routing subsystem contains a divide-by-zero vulnerability in the multipath route rebalancing function. When concurrent route configuration changes occur without proper locking, an arithmetic operation attempts to divide by zero, causing the kernel to crash or become unstable. This can lead to denial of service on systems using IPv6 multipath routing.
Technical details
The vulnerability exists in the rt6_upper_bound_set() function within net/ipv6/route.c. The rt6_multipath_rebalance() function calculates eligible nexthop weights in two passes, but lacks proper synchronization. When RTM_NEWROUTE (RTNL-free route updates) race with ignore_routes_with_linkdown configuration changes, the first pass can return zero total weight while the second pass identifies eligible nexthops, leading to division by zero at line 4845. The fix adds a check to skip the upper-bound calculation when total weight is zero. Attack vector is local/adjacent network; no special authentication required but requires ability to modify IPv6 multipath routes.
Affected products
- Linux Linux kernel All versions with IPv6 multipath routing support (Linux 4.15+)
Timeline
- 2026-09-16: disclosed: CVE-2026-89790 published
- 2026-08-20: patched: Upstream fix merged by Jakub Kicinski
- 2026-09-14: patched: Stable tree backport by Greg Kroah-Hartman