CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible infinite loop in fib6selectpath()
Found while auditing the same pattern Sashiko reported in rt6fillnode() [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6infousesdev()").
Writers holding tb6lock can listdelrcu(&first->fib6siblings) without waiting for RCU readers; first->fib6siblings.next then still points into the old ring and this softirq-side walker never reaches &first->fib6siblings as its terminator. fib6purgert() always WRITEONCE()s first->fib6nsiblings to 0 before listdelrcu(), so an inside-loop check is a reliable detach signal.
[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63968?
CVE-2026-63968 has a risk rating of 23, indicating a potentially serious impact.
What kind of vulnerability is CVE-2026-63968?
CVE-2026-63968 is a vulnerability in the Linux kernel related to possible infinite loops in the fib6_select_path() function.
How do I fix CVE-2026-63968?
To mitigate CVE-2026-63968, ensure your Linux kernel is updated to the latest version where the fix has been applied.
What systems are affected by CVE-2026-63968?
CVE-2026-63968 affects systems running vulnerable versions of the Linux kernel that utilize IPv6.
How was CVE-2026-63968 discovered?
CVE-2026-63968 was discovered during an audit of the Linux kernel, particularly while reviewing similar patterns in the code.