All vulnerabilities
CVE-2026-97940

Linux: ipv6: fix fib6 walker UAF on seq stop

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9a3f73d62c86271614eda4c43315230896a37018Also 63407cddabc5992b5ac03af165559f4a1968a032, 05b687ee04f816658f4a9cf586f4d2f129157943 and 4 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 9a3f73d62c86271614eda4c43315230896a37018LinuxCVE List
  • 63407cddabc5992b5ac03af165559f4a1968a032LinuxCVE List
  • 05b687ee04f816658f4a9cf586f4d2f129157943LinuxCVE List
  • 14fdaba201fdff92a3e45994e02bccda409cb19dLinuxCVE List
  • 0eede1689610e9eeaf729ba86fd1321799eb91a0LinuxCVE List
  • 4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02LinuxCVE List
Show all 7 fixed versions
  • 19b4ed644d68098cc62ab612727f40d30f43476cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix fib6 walker UAF on seq stop

ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker.

Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked.

The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race.

Text from CVE List

Affected versions 18

  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 9a3f73d62c86271614eda4c43315230896a37018CVE List
  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 63407cddabc5992b5ac03af165559f4a1968a032CVE List
  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 05b687ee04f816658f4a9cf586f4d2f129157943CVE List
  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 14fdaba201fdff92a3e45994e02bccda409cb19dCVE List
  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 0eede1689610e9eeaf729ba86fd1321799eb91a0CVE List
  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before b89b691dd00bf39b9ba39ab9446f8c62f419fa7bCVE List
  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02CVE List
  • Linuxaffected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 before 19b4ed644d68098cc62ab612727f40d30f43476cCVE List
  • Linuxaffected: 3.13CVE List
  • Linuxunaffected: all versions before 3.13CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8