FKIE_CVE-2026-97974

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-10-19 10:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0]. The stack trace hinted towards a null dereference of rt->fib6_node when fn->leaf is accessed in __ip6_del_rt_siblings(). With RTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run concurrently without acquiring the RTNL lock. In ip6_route_del(), the route lookup happens under rcu_read_lock() without acquiring table->tb6_lock. Between ip6_route_del() looking up the route and __ip6_del_rt_siblings() acquiring table->tb6_lock, another thread can modify the routing table. For example, when an ECMP route is replaced via RTM_NEWROUTE with NLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets iter->fib6_node = NULL. A reproducer was found that triggers this [1]. Add a check to ensure rt->fib6_node is non-null before accessing it. [0] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056 Call Trace: <TASK> ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232 inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800 __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0x565/0x870 net/socket.c:2713 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767 __sys_sendmsg net/socket.c:2799 [inline] __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> [1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1155234c2227cf36072a43e1e09119472ade7ca7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cdca92eddc025fdb90071be97738f7d55a65f8dd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e7ff91f19c1aae039a4257fa86fe849afe185291
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7ff91f19c1aae039a4257fa86fe849afe185291",
              "status": "affected",
              "version": "bd11ff421d36abdb585b9104fa70057bf01b3110",
              "versionType": "git"
            },
            {
              "lessThan": "1155234c2227cf36072a43e1e09119472ade7ca7",
              "status": "affected",
              "version": "bd11ff421d36abdb585b9104fa70057bf01b3110",
              "versionType": "git"
            },
            {
              "lessThan": "cdca92eddc025fdb90071be97738f7d55a65f8dd",
              "status": "affected",
              "version": "bd11ff421d36abdb585b9104fa70057bf01b3110",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()\n\nsyzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].\n\nThe stack trace hinted towards a null dereference of rt-\u003efib6_node when\nfn-\u003eleaf is accessed in __ip6_del_rt_siblings(). With\nRTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run\nconcurrently without acquiring the RTNL lock. In ip6_route_del(), the\nroute lookup happens under rcu_read_lock() without acquiring\ntable-\u003etb6_lock.\n\nBetween ip6_route_del() looking up the route and __ip6_del_rt_siblings()\nacquiring table-\u003etb6_lock, another thread can modify the routing table.\nFor example, when an ECMP route is replaced via RTM_NEWROUTE with\nNLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets\niter-\u003efib6_node = NULL. A reproducer was found that triggers this [1].\n\nAdd a check to ensure rt-\u003efib6_node is non-null before accessing it.\n\n[0]\nKASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\nRIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056\nCall Trace:\n \u003cTASK\u003e\n ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232\n inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669\n rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900\n sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800\n __sock_sendmsg net/socket.c:815 [inline]\n ____sys_sendmsg+0x565/0x870 net/socket.c:2713\n ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767\n __sys_sendmsg net/socket.c:2799 [inline]\n __do_sys_sendmsg net/socket.c:2804 [inline]\n __se_sys_sendmsg net/socket.c:2802 [inline]\n __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\n[1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899"
    }
  ],
  "id": "CVE-2026-97974",
  "lastModified": "2026-10-19T10:17:48.773",
  "metrics": {},
  "published": "2026-09-25T11:17:25.310",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1155234c2227cf36072a43e1e09119472ade7ca7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cdca92eddc025fdb90071be97738f7d55a65f8dd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e7ff91f19c1aae039a4257fa86fe849afe185291"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.