UBUNTU-CVE-2026-89790: Divide by Zero
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6multipathrebalance rt6multipathrebalance() calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTMNEWROUTE is RTNL-free, a concurrent ignorerouteswithlinkdown update can make the first pass return zero while the second sees an eligible nexthop, causing rt6upperboundset() to divide by zero. UBSAN: division-overflow in net/ipv6/route.c:4845:17 Oops: divide error: 0000 [#1] SMP KASAN NOPTI rt6upperboundset() net/ipv6/route.c:4845 rt6multipathrebalance() fib6addrt2node() ip6routemultipathadd() inet6rtmnewroute() Skip upper-bound calculation when the first pass reports a zero total. This respects the lock-free performance considerations here and solves insecure scenarios.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In rt6_multipath_rebalance(), skip the upper-bound calculation when the first pass reports a zero total eligible nexthop weight.
Event History
Frequently Asked Questions
What conditions are required to trigger the divide-by-zero fault?
A concurrent update to ignore_routes_with_linkdown must occur while IPv6 multipath route rebalancing is processing a route update. The first pass must find zero eligible nexthop weight, while the second pass sees an eligible nexthop and attempts to calculate its upper bound.
What is the likely impact if the issue is triggered?
The kernel can hit a divide-by-zero error in rt6_upper_bound_set(), producing an oops. The provided data describes a kernel fault condition, not data disclosure or privilege escalation.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What does the fix change?
The fix skips upper-bound calculation when the first rebalancing pass reports a total eligible nexthop weight of zero. This prevents the later division by zero while retaining the lock-free behavior of the route-update path.