CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix fib6 walker UAF on seq stop
ipv6routeiteractive() treats a walker in FWSU at the table root as already unlinked. fib6delroute() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6routenativeseqstop() skips fib6walkerunlink(). The seq private object can then be freed while it remains on net->ipv6.fib6walkers. A later route deletion walks the dangling list and uses the freed walker.
Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked.
The same stop helper is used by /proc/net/ipv6route and by the BPF ipv6route iterator. The BPF show path only widens the race.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this use-after-free condition?
Linux systems that use the IPv6 route iterator are exposed. The affected stop helper is used by /proc/net/ipv6_route and the BPF ipv6_route iterator; the BPF show path widens the race.
What conditions are needed to trigger the issue?
A route iterator must leave a walker linked after its seq private object is freed, which can occur when fib6_del_route() handles the last route at the table root. A later IPv6 route deletion can then traverse the dangling walker list and access freed memory.
How can administrators reduce exposure before applying the fix?
The provided information identifies /proc/net/ipv6_route and the BPF ipv6_route iterator as affected paths, but does not provide a verified configuration workaround. Prioritize applying a kernel version containing one of the referenced fixes.