CVE-2026-63969 (GCVE-0-2026-63969)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55
VLAI
Title
ipv6: fix possible infinite loop in rt6_fill_node()
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6_fill_node() Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings) without waiting for RCU readers; rt->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal. [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 , < b014a63d2f2c2c767762b548381882dfb1655529 (git)
Affected: 52da02521ede55fb86546c3fffd9377b3261b91f , < 279853aec9f58d5cd723e6e5617c1c3337b30383 (git)
Affected: 34a949e7a0869dfa31a40416d2a56973fae1807b , < c65b1f60237daac7c56c2652e064cc566a45dc81 (git)
Affected: d9ccb18f83ea2bb654289b6ecf014fd267cc988b , < dc36a04621dcc2447dae428709207810b6c06e14 (git)
Affected: d9ccb18f83ea2bb654289b6ecf014fd267cc988b , < 5e40de719ee76b8d96e2556ce36dbd3bd07bf37d (git)
Affected: d9ccb18f83ea2bb654289b6ecf014fd267cc988b , < 9f72412bcf60144f252b0d6205106abf14344abc (git)
Affected: 11edcd026012ac18acee0f1514db3ed1b160fc6f (git)
Affected: 6.1.128 , < 6.1.176 (semver)
Affected: 6.6.75 , < 6.6.143 (semver)
Affected: 6.12.2 , < 6.12.93 (semver)
Affected: 6.11.11 , < 6.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b014a63d2f2c2c767762b548381882dfb1655529",
              "status": "affected",
              "version": "d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2",
              "versionType": "git"
            },
            {
              "lessThan": "279853aec9f58d5cd723e6e5617c1c3337b30383",
              "status": "affected",
              "version": "52da02521ede55fb86546c3fffd9377b3261b91f",
              "versionType": "git"
            },
            {
              "lessThan": "c65b1f60237daac7c56c2652e064cc566a45dc81",
              "status": "affected",
              "version": "34a949e7a0869dfa31a40416d2a56973fae1807b",
              "versionType": "git"
            },
            {
              "lessThan": "dc36a04621dcc2447dae428709207810b6c06e14",
              "status": "affected",
              "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
              "versionType": "git"
            },
            {
              "lessThan": "5e40de719ee76b8d96e2556ce36dbd3bd07bf37d",
              "status": "affected",
              "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
              "versionType": "git"
            },
            {
              "lessThan": "9f72412bcf60144f252b0d6205106abf14344abc",
              "status": "affected",
              "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "11edcd026012ac18acee0f1514db3ed1b160fc6f",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.128",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.143",
              "status": "affected",
              "version": "6.6.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.93",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.128",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.6.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible infinite loop in rt6_fill_node()\n\nSashiko reported this issue [1]. Apply the same fix as\ncommit f8d8ce1b515a (\"ipv6: fix possible infinite loop in fib6_info_uses_dev()\").\n\nWriters holding tb6_lock can list_del_rcu(\u0026rt-\u003efib6_siblings)\nwithout waiting for RCU readers; rt-\u003efib6_siblings.next then still\npoints into the old ring and this softirq-side walker never reaches\n\u0026rt-\u003efib6_siblings, causing a CPU stall. fib6_del_route() always\nWRITE_ONCE()s rt-\u003efib6_nsiblings to 0 before list_del_rcu(), so an\ninside-loop check is a reliable detach signal.\n\n[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:56.330Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b014a63d2f2c2c767762b548381882dfb1655529"
        },
        {
          "url": "https://git.kernel.org/stable/c/279853aec9f58d5cd723e6e5617c1c3337b30383"
        },
        {
          "url": "https://git.kernel.org/stable/c/c65b1f60237daac7c56c2652e064cc566a45dc81"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc36a04621dcc2447dae428709207810b6c06e14"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e40de719ee76b8d96e2556ce36dbd3bd07bf37d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f72412bcf60144f252b0d6205106abf14344abc"
        }
      ],
      "title": "ipv6: fix possible infinite loop in rt6_fill_node()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63969",
    "datePublished": "2026-07-19T14:55:56.330Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-07-19T14:55:56.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63969",
      "date": "2026-09-21",
      "epss": "0.00211",
      "percentile": "0.11702"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/route.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b014a63d2f2c2c767762b548381882dfb1655529",
                    "status": "affected",
                    "version": "d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "279853aec9f58d5cd723e6e5617c1c3337b30383",
                    "status": "affected",
                    "version": "52da02521ede55fb86546c3fffd9377b3261b91f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c65b1f60237daac7c56c2652e064cc566a45dc81",
                    "status": "affected",
                    "version": "34a949e7a0869dfa31a40416d2a56973fae1807b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc36a04621dcc2447dae428709207810b6c06e14",
                    "status": "affected",
                    "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e40de719ee76b8d96e2556ce36dbd3bd07bf37d",
                    "status": "affected",
                    "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f72412bcf60144f252b0d6205106abf14344abc",
                    "status": "affected",
                    "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "11edcd026012ac18acee0f1514db3ed1b160fc6f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.176",
                    "status": "affected",
                    "version": "6.1.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.143",
                    "status": "affected",
                    "version": "6.6.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.93",
                    "status": "affected",
                    "version": "6.12.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "affected",
                    "version": "6.11.11",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/route.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible infinite loop in rt6_fill_node()\n\nSashiko reported this issue [1]. Apply the same fix as\ncommit f8d8ce1b515a (\"ipv6: fix possible infinite loop in fib6_info_uses_dev()\").\n\nWriters holding tb6_lock can list_del_rcu(\u0026rt-\u003efib6_siblings)\nwithout waiting for RCU readers; rt-\u003efib6_siblings.next then still\npoints into the old ring and this softirq-side walker never reaches\n\u0026rt-\u003efib6_siblings, causing a CPU stall. fib6_del_route() always\nWRITE_ONCE()s rt-\u003efib6_nsiblings to 0 before list_del_rcu(), so an\ninside-loop check is a reliable detach signal.\n\n[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev"
          }
        ],
        "id": "CVE-2026-63969",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {},
        "published": "2026-07-19T16:17:15.947",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/279853aec9f58d5cd723e6e5617c1c3337b30383"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5e40de719ee76b8d96e2556ce36dbd3bd07bf37d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9f72412bcf60144f252b0d6205106abf14344abc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b014a63d2f2c2c767762b548381882dfb1655529"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c65b1f60237daac7c56c2652e064cc566a45dc81"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc36a04621dcc2447dae428709207810b6c06e14"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-07T13:49:33+00:00",
      "cve": "CVE-2026-63969",
      "id": "CVE-2026-63969",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: fix possible infinite loop in rt6_fill_node()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63969.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:45:39Z",
      "cve": "CVE-2026-63969",
      "id": "CVE-2026-63969",
      "initial_release_date": "2026-07-21T13:02:30Z",
      "product_status:known_affected": "482",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63969",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63969.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.