CVE-2026-93226: ipv6: use RCU iterator to dump route exceptions
In the Linux kernel, the following vulnerability has been resolved:
ipv6: use RCU iterator to dump route exceptions
rt6nhdumpexceptions() uses hlistforeachentry() to iterate over RCU-protected exception lists. The caller holds rcureadlock(), but does not hold rt6exceptionlock, so rt6insertexception() can concurrently add an entry with hlistaddheadrcu().
KCSAN reports this race (irrelevant details omitted):
================================================================== BUG: KCSAN: data-race in rt6insertexception / rt6nhdumpexceptions
write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5: rt6insertexception+0x3bb/0x760 ip6rtupdatepmtu+0x4fe/0x750 ip6skupdatepmtu+0x19a/0x3b0 udpv6err+0x3ff/0x800 icmpv6notify+0x1e1/0x440 icmpv6rcv+0x8c0/0xab0 ip6protocoldeliverrcu+0x616/0x840 ip6inputfinish+0xb9/0x160 ... entrySYSCALL64afterhwframe+0x77/0x7f
read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14: rt6nhdumpexceptions+0xb3/0x260 rt6dumproute+0x53e/0x5f0 fib6dumpnode+0x6d/0xf0 fib6walkcontinue+0x290/0x2d0 fib6dumptable+0x28d/0x360 inet6dumpfib+0x37d/0x620 rtnldumpit+0x7b/0xd0 netlinkdump+0x3ae/0x7e0 ... entrySYSCALL64afterhwframe+0x77/0x7f
4 locks held by dumper/549: ... #1: (rcureadlock){....}-{1:3}, at: inet6dumpfib+0x88/0x620 #2: (&tb->tb6lock){+.-.}-{3:3}, at: fib6dumptable+0x1e9/0x360 #3: (rcureadlock){....}-{1:3}, at: rt6dumproute+0x483/0x5f0
value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100
Reported by Kernel Concurrency Sanitizer on: CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted 7.2.0-rc7-virtme #38 PREEMPT(lazy) ...
Use hlistforeachentryrcu() to safely iterate over the exception list.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed for the race to occur?
A route-exception dump must run while another execution context inserts a route exception. The reported insertion path can be reached during IPv6 PMTU updates triggered through ICMPv6 processing, while the dump path runs through the IPv6 routing netlink dump path.
Who is most likely to encounter this issue?
Systems that concurrently dump IPv6 routing information and process IPv6 route-exception updates are exposed to the reported race. The report shows the writer can run in interrupt context and the reader can run in a userspace-triggered netlink dump task.
How can I tell whether the issue is occurring?
The supplied evidence is a KCSAN data-race report identifying rt6_insert_exception as the writer and rt6_nh_dump_exceptions as the reader. A matching report involving those functions during IPv6 route dumps and PMTU-related processing indicates the race has been observed.