CVE-2026-98596: ipv6: Fix dst leak for uncached routes.
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix dst leak for uncached routes.
ip6routeoutputflags(), ip6rtputflags(), and ip6dstcheck() detect an uncached route by listempty(&rt->dst.rtuncached), which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 ("net: remove DSTNOCACHE flag").
When a device is unregistered, rt6uncachedlistflushdev() unlinks uncached routes tied to the device from rt6uncachedlist.
Previously, they were moved to another list with listmove() (listdelentry() + listadd()), and since commit 98aa546af5e4 ("inet: remove (struct uncachedlist)->quarantine"), the routes are just unlinked with listdelinit().
If listdelinit() runs concurrently, listempty() evaluates to true; ip6routeoutputflags() calls dstholdsafe() incorrectly and ip6rtputflags() skips ip6rtput(), leaking dst, and thus dev tied via rt->from as well.
The same race is partially fixed by commit 9a6f0c4d5796 ("dst: fix races in rt6uncachedlistdel() and rtdeluncachedlist()").
Let's check rt6->dst.rtuncachedlist instead.
Note that IPv4 does not have the same issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Is IPv4 networking affected by this issue?
No. The issue is specific to IPv6; the provided information states that IPv4 does not have the same problem.
What conditions trigger the resource leak?
The leak can occur when a device is being unregistered while uncached IPv6 routes associated with that device are being handled concurrently. The race can cause destination references, and the device referenced through rt->from, to remain leaked.
What should operators use to remediate the issue?
Use a Linux kernel update that includes the resolution for this vulnerability. The listed stable-kernel references identify commits containing the fix.