CVE-2026-97974 - Vulnerability Details

- ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].

The stack trace hinted towards a null dereference of rt->fib6_node when
fn->leaf is accessed in __ip6_del_rt_siblings(). With
RTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run
concurrently without acquiring the RTNL lock. In ip6_route_del(), the
route lookup happens under rcu_read_lock() without acquiring
table->tb6_lock.

Between ip6_route_del() looking up the route and __ip6_del_rt_siblings()
acquiring table->tb6_lock, another thread can modify the routing table.
For example, when an ECMP route is replaced via RTM_NEWROUTE with
NLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets
iter->fib6_node = NULL. A reproducer was found that triggers this [1].

Add a check to ensure rt->fib6_node is non-null before accessing it.

[0]
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
RIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056
Call Trace:
<TASK>
ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232
inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
__sock_sendmsg net/socket.c:815 [inline]
____sys_sendmsg+0x565/0x870 net/socket.c:2713
___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
__sys_sendmsg net/socket.c:2799 [inline]
__do_sys_sendmsg net/socket.c:2804 [inline]
__se_sys_sendmsg net/socket.c:2802 [inline]
__x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>

[1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference occurs in the IPv6 routing function __ip6_del_rt_siblings() due to a race condition between route deletion and addition. When rt->fib6_node becomes null before the code accesses it, the kernel panics, disrupting network services and potentially causing a full system reboot.

Affected Systems

All systems running the Linux kernel that have not yet included the patch adding the null check to __ip6_del_rt_siblings(). The vulnerability applies to all current releases until the fix is applied, as no specific kernel versions are listed in the advisory.

Risk and Exploitability

The bug is a classic null-pointer dereference (CWE‑476) and can be triggered by concurrent route manipulation. The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% suggests a very low likelihood of current exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can modify routing tables, typically requiring CAP_NET_ADMIN or root privileges. No public exploit is documented, but the risk remains a potential denial of service if exploitation is achieved.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd11ff421d36abdb585b9104fa70057bf01b3110`	affected	< e7ff91f19c1aae039a4257fa86fe849afe185291
`bd11ff421d36abdb585b9104fa70057bf01b3110`	affected	< 1155234c2227cf36072a43e1e09119472ade7ca7
`bd11ff421d36abdb585b9104fa70057bf01b3110`	affected	< cdca92eddc025fdb90071be97738f7d55a65f8dd

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bd11ff421d36abdb585b9104fa70057bf01b3110,e7ff91f19c1aae039a4257fa86fe849afe185291)`	affected	code_commit	—
`[bd11ff421d36abdb585b9104fa70057bf01b3110,1155234c2227cf36072a43e1e09119472ade7ca7)`	affected	code_commit	—
`[bd11ff421d36abdb585b9104fa70057bf01b3110,cdca92eddc025fdb90071be97738f7d55a65f8dd)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.16`	affected	generic	—
`[0,6.16)`	unaffected	generic	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the null‑check patch for __ip6_del_rt_siblings().
If a patched kernel is not yet available, apply the backport patch manually by incorporating the commit that adds the null check before accessing rt->fib6_node.
During the transition period, restrict CAP_NET_ADMIN privileges to trusted users or services to reduce the window for concurrent route modifications.

Generated by OpenCVE AI on September 30, 2026 at 14:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97974.mbox
https://git.kernel.org/stable/c/1155234c2227cf36072a43e1e09119472ade7ca7
https://git.kernel.org/stable/c/cdca92eddc025fdb90071be97738f7d55a65f8dd
https://git.kernel.org/stable/c/e7ff91f19c1aae039a4257fa86fe849afe185291
https://nvd.nist.gov/vuln/detail/CVE-2026-97974
https://www.cve.org/CVERecord?id=CVE-2026-97974

History

Wed, 30 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97974.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97974 https://www.cve.org/CVERecord?id=CVE-2026-97974
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0]. The stack trace hinted towards a null dereference of rt->fib6_node when fn->leaf is accessed in __ip6_del_rt_siblings(). With RTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run concurrently without acquiring the RTNL lock. In ip6_route_del(), the route lookup happens under rcu_read_lock() without acquiring table->tb6_lock. Between ip6_route_del() looking up the route and __ip6_del_rt_siblings() acquiring table->tb6_lock, another thread can modify the routing table. For example, when an ECMP route is replaced via RTM_NEWROUTE with NLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets iter->fib6_node = NULL. A reproducer was found that triggers this [1]. Add a check to ensure rt->fib6_node is non-null before accessing it. [0] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056 Call Trace: <TASK> ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232 inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800 __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0x565/0x870 net/socket.c:2713 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767 __sys_sendmsg net/socket.c:2799 [inline] __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> [1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899
Title		ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1155234c2227cf36072a43e1e09119472ade7ca7 https://git.kernel.org/stable/c/cdca92eddc025fdb90071be97738f7d55a65f8dd https://git.kernel.org/stable/c/e7ff91f19c1aae039a4257fa86fe849afe185291

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:13.373Z

Updated: 2026-09-25T10:23:13.373Z

Reserved: 2026-09-25T10:18:58.207Z

Link: CVE-2026-97974

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:25.310

Modified: 2026-09-25T11:17:25.310

Link: CVE-2026-97974

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-97974 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-30T15:00:12Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object