CVE-2026-63969

ipv6: fix possible infinite loop in rt6_fill_node()

State: Published
Severity: Not scored
Published: Jul 19, 2026
Updated: Jul 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible infinite loop in rt6_fill_node()

Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()").

Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings) without waiting for RCU readers; rt->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal.

[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 to before b014a63d2f2c2c767762b548381882dfb1655529Affected 52da02521ede55fb86546c3fffd9377b3261b91f to before 279853aec9f58d5cd723e6e5617c1c3337b30383Affected 34a949e7a0869dfa31a40416d2a56973fae1807b to before c65b1f60237daac7c56c2652e064cc566a45dc81Affected d9ccb18f83ea2bb654289b6ecf014fd267cc988b to before dc36a04621dcc2447dae428709207810b6c06e14Affected d9ccb18f83ea2bb654289b6ecf014fd267cc988b to before 5e40de719ee76b8d96e2556ce36dbd3bd07bf37dAffected d9ccb18f83ea2bb654289b6ecf014fd267cc988b to before 9f72412bcf60144f252b0d6205106abf14344abcAffected 11edcd026012ac18acee0f1514db3ed1b160fc6fAffected 6.1.128 to before 6.1.176Affected 6.6.75 to before 6.6.143Affected 6.12.2 to before 6.12.93Affected 6.11.11 to before 6.12Affected
LinuxLinux	6.13Affected before 6.13Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 to before b014a63d2f2c2c767762b548381882dfb1655529Affected
52da02521ede55fb86546c3fffd9377b3261b91f to before 279853aec9f58d5cd723e6e5617c1c3337b30383Affected
34a949e7a0869dfa31a40416d2a56973fae1807b to before c65b1f60237daac7c56c2652e064cc566a45dc81Affected
d9ccb18f83ea2bb654289b6ecf014fd267cc988b to before dc36a04621dcc2447dae428709207810b6c06e14Affected
d9ccb18f83ea2bb654289b6ecf014fd267cc988b to before 5e40de719ee76b8d96e2556ce36dbd3bd07bf37dAffected
d9ccb18f83ea2bb654289b6ecf014fd267cc988b to before 9f72412bcf60144f252b0d6205106abf14344abcAffected
11edcd026012ac18acee0f1514db3ed1b160fc6fAffected
6.1.128 to before 6.1.176Affected
6.6.75 to before 6.6.143Affected
6.12.2 to before 6.12.93Affected
6.11.11 to before 6.12Affected

LinuxLinux

6.13Affected
before 6.13Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.