CVE-2026-99121: ipv4: avoid divide by zero in fib_rebalance
In the Linux kernel, the following vulnerability has been resolved:
ipv4: avoid divide by zero in fibrebalance
fibrebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignorerouteswithlinkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero.
If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6multipathrebalance") and preserves the lock-free rebalance path.
Event History
Frequently Asked Questions
What condition is required to trigger the fault?
The issue requires a concurrent change to ignore_routes_with_linkdown while fib_rebalance() is running. The first pass must calculate a zero eligible nexthop weight, while the second pass subsequently sees an eligible nexthop and attempts the division.
What does the fix do when no eligible nexthop weight is found?
When the first pass reports a zero total, the fix sets every nexthop upper bound to -1 and skips the division. The rebalance path remains lock-free.