UBUNTU-CVE-2026-99070

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99070 ipv6: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99070

The Linux kernel contains a vulnerability related to an IPv6 route notification size race. Specifically, in fib6_info_hw_flags_set() , the socket buffer (skb) is sized using rt6_nlmsg_size() but populated via rt6_fill_node() . When nexthop compatibility mode is enabled, a concurrent replacement c...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.12. It stems from a race condition related to the size of IPv6 routing notifications. When fib6infohwflagsset uses rt6nlmsgsize to set the skb size, it is subsequently filled by rt6fillnode. In Nexthop-compatible mode, concurrent...

ROS-20260922-73-0045

The vulnerability of the rt6fillnode function in the net/ipv6/route.c module of the IPv6 protocol implementation in the Linux operating system is related to the execution of a loop with an unreachable exit condition an “infinite loop”. Exploitation of this vulnerability could allow a remote...

Linux kernel IPv6 DoS

The vulnerability in the rt6fillnode function within net/ipv6/route.c of the Linux kernel’s IPv6 implementation is related to the execution of an infinite loop due to an unreachable condition. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

SUSE CVE-2026-63969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-63969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-63969 ipv6: fix possible infinite loop in rt6_fill_node()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-63969: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2025-38638: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: add a retry logic in net6rtnotify inet6rtnotify can be called under RCU protection only. This means the route could be changed concurrently and rt6fillnode could return -EMSGSIZE. Re-size the skb when this happens and retry...

CVE-2008-3686

The rt6fillnode function in net/ipv6/route.c in Linux kernel 2.6.26-rc4, 2.6.26.2, and possibly other 2.6.26 versions, allows local users to cause a denial of service kernel OOPS via IPv6 requests when no IPv6 input device is in use, which triggers a NULL pointer dereference...

CVE-2008-3686

The rt6fillnode function in net/ipv6/route.c in Linux kernel 2.6.26-rc4, 2.6.26.2, and possibly other 2.6.26 versions, allows local users to cause a denial of service kernel OOPS via IPv6 requests when no IPv6 input device is in use, which triggers a NULL pointer dereference...

Null pointer dereference

The rt6fillnode function in net/ipv6/route.c in Linux kernel 2.6.26-rc4, 2.6.26.2, and possibly other 2.6.26 versions, allows local users to cause a denial of service kernel OOPS via IPv6 requests when no IPv6 input device is in use, which triggers a NULL pointer dereference...

CVE-2008-3686: Undefined Security Weakness

The rt6fillnode function in net/ipv6/route.c in Linux kernel 2.6.26-rc4, 2.6.26.2, and possibly other 2.6.26 versions, allows local users to cause a denial of service kernel OOPS via IPv6 requests when no IPv6 input device is in use, which triggers a NULL pointer dereference...