CVE-2026-23200 - Vulnerability Details

- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF

syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6
route. [0]

Commit f72514b3c569 ("ipv6: clear RA flags when adding a static
route") introduced logic to clear RTF_ADDRCONF from existing routes
when a static route with the same nexthop is added. However, this
causes a problem when the existing route has a gateway.

When RTF_ADDRCONF is cleared from a route that has a gateway, that
route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns
true. The issue is that this route was never added to the
fib6_siblings list.

This leads to a mismatch between the following counts:

- The sibling count computed by iterating fib6_next chain, which
includes the newly ECMP-eligible route

- The actual siblings in fib6_siblings list, which does not include
that route

When a subsequent ECMP route is added, fib6_add_rt2node() hits
BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the
counts don't match.

Fix this by only clearing RTF_ADDRCONF when the existing route does
not have a gateway. Routes without a gateway cannot qualify for ECMP
anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing
RTF_ADDRCONF on them is safe and matches the original intent of the
commit.

[0]:
kernel BUG at net/ipv6/ip6_fib.c:1217!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217
[...]
Call Trace:
<TASK>
fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532
__ip6_ins_rt net/ipv6/route.c:1351 [inline]
ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946
ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571
inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577
sock_do_ioctl+0xdc/0x300 net/socket.c:1245
sock_ioctl+0x576/0x790 net/socket.c:1366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Published: 2026-02-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s IPv6 route handling causes a mismatch in ECMP sibling counts when a static route that matches an existing gateway route is added, leading to a BUG_ON that triggers a kernel panic. The crash results in a loss of system availability, effectively a denial‑of‑service condition.

Affected Systems

All Linux kernel builds that include the vulnerability, specifically the release candidate series 6.19 rc1 through rc8 and any earlier kernels that have not incorporated the patch that restricts RTF_ADDRCONF clearing to routes without gateways.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability requires privileged access to add or modify IPv6 routes, so it is primarily a local privilege escalation issue. The bug is not listed in the CISA KEV catalog, further indicating limited real‑world impact at present. Nevertheless, the potential for a kernel panic warrants prompt patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cb2b0caa8ca93cbe39177516669bf699c74f7041`	affected	< 50b7c7a255858a85c4636a1e990ca04591153dca
`03f642caab84bbfd138e74f671bb436186ea7e82`	affected	< d8143c54ceeba232dc8a13aa0afa14a44b371d93
`3e5b25da0b4109a3e063759735e6ec4236ea5a05`	affected	< b8ad2d53f706aeea833d23d45c0758398fede580
`f72514b3c5698e4b900b25345e09f9ed33123de6`	affected	< bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25
`61d88ea0f30c88e4ea98793594943aed8f1fc9ab`	affected	—

Linux

unaffected

Version	Status	Constraints
`6.6.120`	affected	< 6.6.124
`6.12.63`	affected	< 6.12.70
`6.18.2`	affected	< 6.18.10

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc8::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[cb2b0caa8ca93cbe39177516669bf699c74f7041,50b7c7a255858a85c4636a1e990ca04591153dca)`	affected	code_commit	—
`[03f642caab84bbfd138e74f671bb436186ea7e82,d8143c54ceeba232dc8a13aa0afa14a44b371d93)`	affected	code_commit	—
`[3e5b25da0b4109a3e063759735e6ec4236ea5a05,b8ad2d53f706aeea833d23d45c0758398fede580)`	affected	code_commit	—
`[f72514b3c5698e4b900b25345e09f9ed33123de6,bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25)`	affected	code_commit	—
`[61d88ea0f30c88e4ea98793594943aed8f1fc9ab,*]`	affected	code_commit	—

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[6.6.120,6.6.124)`	affected	semver	—
`[6.12.63,6.12.70)`	affected	semver	—
`[6.18.2,6.18.10)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that limits RTF_ADDRCONF clearing to non‑gateway routes, which is included in the latest stable kernel releases.
Upgrade the system to the newest kernel version where the patch has been merged (e.g., any kernel following the 6.19 release candidates).
After updating, reboot the system to ensure the patched kernel is in use.

Generated by OpenCVE AI on April 17, 2026 at 19:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6141-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00017.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/50b7c7a255858a85c4636a1e990ca04591153dca
https://git.kernel.org/stable/c/b8ad2d53f706aeea833d23d45c0758398fede580
https://git.kernel.org/stable/c/bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25
https://git.kernel.org/stable/c/d8143c54ceeba232dc8a13aa0afa14a44b371d93
https://lore.kernel.org/linux-cve-announce/2026021436-CVE-2026-23200-e35e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23200
https://www.cve.org/CVERecord?id=CVE-2026-23200

History

Thu, 19 Mar 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc7:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc8::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Tue, 17 Feb 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021436-CVE-2026-23200-e35e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23200 https://www.cve.org/CVERecord?id=CVE-2026-23200
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 14 Feb 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6 route. [0] Commit f72514b3c569 ("ipv6: clear RA flags when adding a static route") introduced logic to clear RTF_ADDRCONF from existing routes when a static route with the same nexthop is added. However, this causes a problem when the existing route has a gateway. When RTF_ADDRCONF is cleared from a route that has a gateway, that route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns true. The issue is that this route was never added to the fib6_siblings list. This leads to a mismatch between the following counts: - The sibling count computed by iterating fib6_next chain, which includes the newly ECMP-eligible route - The actual siblings in fib6_siblings list, which does not include that route When a subsequent ECMP route is added, fib6_add_rt2node() hits BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the counts don't match. Fix this by only clearing RTF_ADDRCONF when the existing route does not have a gateway. Routes without a gateway cannot qualify for ECMP anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing RTF_ADDRCONF on them is safe and matches the original intent of the commit. [0]: kernel BUG at net/ipv6/ip6_fib.c:1217! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217 [...] Call Trace: <TASK> fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946 ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571 inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577 sock_do_ioctl+0xdc/0x300 net/socket.c:1245 sock_ioctl+0x576/0x790 net/socket.c:1366 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Title		ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/50b7c7a255858a85c4636a1e990ca04591153dca https://git.kernel.org/stable/c/b8ad2d53f706aeea833d23d45c0758398fede580 https://git.kernel.org/stable/c/bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25 https://git.kernel.org/stable/c/d8143c54ceeba232dc8a13aa0afa14a44b371d93

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-14T16:27:25.025Z

Updated: 2026-02-14T16:27:25.025Z

Reserved: 2026-01-13T15:37:45.986Z

Link: CVE-2026-23200

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-02-14T17:15:57.847

Modified: 2026-03-19T16:41:38.177

Link: CVE-2026-23200

Redhat

Severity : Moderate

Publid Date: 2026-02-14T00:00:00Z

Links: CVE-2026-23200 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-17T19:30:15Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object