CVE-2026-89790: ipv6: avoid divide by zero in rt6_multipath_rebalance
In the Linux kernel, the following vulnerability has been resolved:
ipv6: avoid divide by zero in rt6multipathrebalance
rt6multipathrebalance() calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTMNEWROUTE is RTNL-free, a concurrent ignorerouteswithlinkdown update can make the first pass return zero while the second sees an eligible nexthop, causing rt6upperboundset() to divide by zero.
UBSAN: division-overflow in net/ipv6/route.c:4845:17 Oops: divide error: 0000 [#1] SMP KASAN NOPTI rt6upperboundset() net/ipv6/route.c:4845 rt6multipathrebalance() fib6addrt2node() ip6routemultipathadd() inet6rtmnewroute()
Skip upper-bound calculation when the first pass reports a zero total. This respects the lock-free performance considerations here and solves insecure scenarios.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The issue requires concurrent route activity: an RTM_NEWROUTE operation must race with an update to ignore_routes_with_linkdown. The first multipath nexthop pass must see no eligible weight, while the second pass sees an eligible nexthop.
What is the observable impact if the race occurs?
The kernel can divide by zero in rt6_upper_bound_set() during IPv6 multipath route rebalancing. Reported symptoms include a UBSAN division-overflow report and an Oops caused by a divide error.
What mitigation is available if the fix cannot be applied immediately?
The provided data identifies the triggering race between RTM_NEWROUTE and ignore_routes_with_linkdown updates, but does not provide a supported configuration-only mitigation. Reducing or avoiding concurrent execution of those operations may avoid the described race, but this is not stated as a complete workaround.
How can administrators identify that they have encountered this vulnerability?
Look for UBSAN division-overflow reports in net/ipv6/route.c at rt6_upper_bound_set(), or kernel Oops messages reporting a divide error with rt6_upper_bound_set(), rt6_multipath_rebalance(), fib6_add_rt2node(), ip6_route_multipath_add(), and inet6_rtm_newroute() in the call stack.