Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-93226

ipv6: use RCU iterator to dump route exceptions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over RCU-protected exception lists. The caller holds rcu_read_lock(), but does not hold rt6_exception_lock, so rt6_insert_exception() can concurrently add an entry with hlist_add_head_rcu(). KCSAN reports this race (irrelevant details omitted): ================================================================== BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5: rt6_insert_exception+0x3bb/0x760 __ip6_rt_update_pmtu+0x4fe/0x750 ip6_sk_update_pmtu+0x19a/0x3b0 udpv6_err+0x3ff/0x800 icmpv6_notify+0x1e1/0x440 icmpv6_rcv+0x8c0/0xab0 ip6_protocol_deliver_rcu+0x616/0x840 ip6_input_finish+0xb9/0x160 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14: rt6_nh_dump_exceptions+0xb3/0x260 rt6_dump_route+0x53e/0x5f0 fib6_dump_node+0x6d/0xf0 fib6_walk_continue+0x290/0x2d0 fib6_dump_table+0x28d/0x360 inet6_dump_fib+0x37d/0x620 rtnl_dumpit+0x7b/0xd0 netlink_dump+0x3ae/0x7e0 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f 4 locks held by dumper/549: ... #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620 #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360 #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0 value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100 Reported by Kernel Concurrency Sanitizer on: CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted 7.2.0-rc7-virtme #38 PREEMPT(lazy) ... Use hlist_for_each_entry_rcu() to safely iterate over the exception list.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < dffbfb3117138e8e0e09d05f507bd36ca1f696e5affected
  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < 6bd3f94ed858f2d072627546b4cdf712b0f8ea88affected
  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < 9c6be625e1a7258e845d6193b3b6b084a00f8e9eaffected
  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < 3665abc3d2ae8a78cb67f858e848481432ec75dbaffected
  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < eda56ee17713f9dd834b922f7dbfa2e25fa6358caffected
  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < a602cd128d17a793e12888edc8eda85821ede7e1affected
  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < f6b1b15848fd91fe122dac0d19d3d666e35075b6affected
  • 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 to < 47cdab0d51aaa9bd85f8e4904585bd5bd4df4488affected

Linux Linux

Default version status: affected

  • 5.3affected
  • 0 to < 5.3unaffected
  • 5.10.270 to ≤ 5.10.*unaffected
  • 5.15.221 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.109 to ≤ 6.12.*unaffected
  • 6.18.50 to ≤ 6.18.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References