CVE-2026-97940 (GCVE-0-2026-97940)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-09-25 14:41
VLAI
Title
ipv6: fix fib6 walker UAF on seq stop
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 , < 0eede1689610e9eeaf729ba86fd1321799eb91a0 (git)
Affected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 , < b89b691dd00bf39b9ba39ab9446f8c62f419fa7b (git)
Affected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 , < 4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02 (git)
Affected: 8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7 , < 19b4ed644d68098cc62ab612727f40d30f43476c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_fib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0eede1689610e9eeaf729ba86fd1321799eb91a0",
              "status": "affected",
              "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
              "versionType": "git"
            },
            {
              "lessThan": "b89b691dd00bf39b9ba39ab9446f8c62f419fa7b",
              "status": "affected",
              "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
              "versionType": "git"
            },
            {
              "lessThan": "4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02",
              "status": "affected",
              "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
              "versionType": "git"
            },
            {
              "lessThan": "19b4ed644d68098cc62ab612727f40d30f43476c",
              "status": "affected",
              "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_fib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet-\u003eipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w-\u003enode check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by a local read() of /proc/net/ipv6_route (ipv6_route_native_seq_stop via ipv6_route_seq_ops, or the BPF ipv6_route iterator) racing a local RTM_DELROUTE netlink request that runs fib6_del_route(). No remote protocol supplies data that causes the missed fib6_walker_unlink().\nAC:L - The attacker controls both sides of the race. One thread reads /proc/net/ipv6_route while another repeatedly adds and deletes the last route in the table root (e.g. ::/0), which moves the linked walker to FWS_U at the root so seq_stop skips the unlink. The attempt can be retried freely.\nPR:L - /proc/net/ipv6_route is created with mode 0 (0444, world-readable). Deleting routes needs CAP_NET_ADMIN only over the namespace, which an unprivileged user gets with unshare -Urn, and net-\u003eipv6.fib6_walkers is per-namespace, so the whole attack runs in an attacker-owned netns.\nUI:N - No victim action is needed. The attacker opens, reads and closes the proc file and issues the route deletions themselves.\nS:U - The use-after-free happens in kernel heap memory and gives kernel-level impact within the same security authority. No VM or hardware isolation boundary is crossed.\nC:H - The freed seq_file private object (struct ipv6_route_iter, holding the fib6_walker) stays on net-\u003eipv6.fib6_walkers. Later FOR_WALKERS loops read w-\u003estate, w-\u003eleaf and w-\u003enode from memory the attacker can reallocate with controlled contents, a UAF usable for kernel memory disclosure.\nI:H - fib6_del_route() and fib6_repair_tree() write w-\u003eleaf, w-\u003estate and w-\u003enode into the freed walker, and list_add/list_del on w-\u003elh write pointers into it. That is a write primitive into a reallocated kernel heap object, usable for corruption and privilege escalation.\nA:H - Any later route deletion or tree repair in that namespace walks the dangling fib6_walkers entry, which causes list corruption or a KASAN/oops crash of the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:42.075Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02"
        },
        {
          "url": "https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c"
        }
      ],
      "title": "ipv6: fix fib6 walker UAF on seq stop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97940",
    "datePublished": "2026-09-25T10:22:52.936Z",
    "dateReserved": "2026-09-25T10:18:58.204Z",
    "dateUpdated": "2026-09-25T14:41:42.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97940",
      "date": "2026-09-26",
      "epss": "0.00163",
      "percentile": "0.0492"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/ip6_fib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0eede1689610e9eeaf729ba86fd1321799eb91a0",
                    "status": "affected",
                    "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b89b691dd00bf39b9ba39ab9446f8c62f419fa7b",
                    "status": "affected",
                    "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02",
                    "status": "affected",
                    "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "19b4ed644d68098cc62ab612727f40d30f43476c",
                    "status": "affected",
                    "version": "8d2ca1d7b5c3e63b3a8a81ae99015b615c5f2bf7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/ip6_fib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.13"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet-\u003eipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w-\u003enode check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race."
          }
        ],
        "id": "CVE-2026-97940",
        "lastModified": "2026-09-25T15:18:02.713",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:21.410",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.