ipv6: fix possible infinite loop in fib6_select_path()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-63968
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:15 UTC
Updated2026-07-20 15:16:59 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_select_path() Found while auditing the same pattern Sashiko reported in rt6_fill_node() [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&first->fib6_siblings) without waiting for RCU readers; first->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &first->fib6_siblings as its terminator. fib6_purge_rt() always WRITE_ONCE()s first->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal. [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.002050000 probability, percentile 0.107250000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 3948a7d92f7678e89e1776bb2d169afcad63b1ae git Not specified
CNA Linux Linux affected 52da02521ede55fb86546c3fffd9377b3261b91f c87cd3cb309634bc8f50a54e2079424f219ac21f git Not specified
CNA Linux Linux affected 34a949e7a0869dfa31a40416d2a56973fae1807b 0f7b73c3452635de83b8711b31abdda8e49aad7b git Not specified
CNA Linux Linux affected d9ccb18f83ea2bb654289b6ecf014fd267cc988b ab9a10969a907b472a0196d999c08ff7144172e3 git Not specified
CNA Linux Linux affected d9ccb18f83ea2bb654289b6ecf014fd267cc988b 9b9d5bd6e3d4c9cecab5407604b690684b2532d2 git Not specified
CNA Linux Linux affected d9ccb18f83ea2bb654289b6ecf014fd267cc988b 9c7da87c2dc860bb17ca1ece942495d28b1ce3b9 git Not specified
CNA Linux Linux affected 11edcd026012ac18acee0f1514db3ed1b160fc6f git Not specified
CNA Linux Linux affected 6.1.128 6.1.176 semver Not specified
CNA Linux Linux affected 6.6.75 6.6.143 semver Not specified
CNA Linux Linux affected 6.12.2 6.12.93 semver Not specified
CNA Linux Linux affected 6.11.11 6.12 semver Not specified
CNA Linux Linux affected 6.13 Not specified
CNA Linux Linux unaffected 6.13 semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.93 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.35 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.12 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/0f7b73c3452635de83b8711b31abdda8e49aad7b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9b9d5bd6e3d4c9cecab5407604b690684b2532d2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3948a7d92f7678e89e1776bb2d169afcad63b1ae 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9c7da87c2dc860bb17ca1ece942495d28b1ce3b9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ab9a10969a907b472a0196d999c08ff7144172e3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c87cd3cb309634bc8f50a54e2079424f219ac21f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report