CVE-2026-97974

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].

The stack trace hinted towards a null dereference of rt->fib6_node when

fn->leaf is accessed in __ip6_del_rt_siblings(). With

RTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run

concurrently without acquiring the RTNL lock. In ip6_route_del(), the

route lookup happens under rcu_read_lock() without acquiring

table->tb6_lock.

Between ip6_route_del() looking up the route and __ip6_del_rt_siblings()

acquiring table->tb6_lock, another thread can modify the routing table.

For example, when an ECMP route is replaced via RTM_NEWROUTE with

NLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets

iter->fib6_node = NULL. A reproducer was found that triggers this [1].

Add a check to ensure rt->fib6_node is non-null before accessing it.

[0]

KASAN: null-ptr-deref in ran

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References