CVE-2026-97940ipv6: fix fib6 walker UAF on seq stop
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 9a3f73d62c86271614eda4c43315230896a37018; from 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 63407cddabc5992b5ac03af165559f4a1968a032; 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 builds before 05b687ee04f816658f4a9cf586f4d2f129157943; from 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 14fdaba201fdff92a3e45994e02bccda409cb19d; 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 builds before 0eede1689610e9eeaf729ba86fd1321799eb91a0; from 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before b89b691dd00bf39b9ba39ab9446f8c62f419fa7b; from 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02; from 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 19b4ed644d68098cc62ab612727f40d30f43476c | CNA record |
References
- https://git.kernel.org/stable/c/9a3f73d62c86271614eda4c43315230896a37018
- https://git.kernel.org/stable/c/63407cddabc5992b5ac03af165559f4a1968a032
- https://git.kernel.org/stable/c/05b687ee04f816658f4a9cf586f4d2f129157943
- https://git.kernel.org/stable/c/14fdaba201fdff92a3e45994e02bccda409cb19d
- https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0
- https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b
- https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02
- https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.