CVE-2026-98598

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Prevent rt6_insert_exception() for dying fib6_info.

Before the cited commit, fib6_nh_flush_exceptions() always set

from->exception_bucket_flushed = 1 under rt6_exception_lock to

prevent rt6_insert_exception() from inserting a new exception

for a dying fib6_info.

The flag was replaced with the FIB6_EXCEPTION_BUCKET_FLUSHED

bit stored in nh->rt6i_exception_bucket.

The problem is that now the bit is only set when the bucket

is not NULL and fib6_nh_flush_exceptions() is called from

fib6_nh_release() after fib6_ref has already reached zero.

If rt6_insert_exception() is called while the target fib6_info

is being removed via fib6_purge_rt(), a new exception could be

created successfully because rt6_flush_exceptions() no longer

sets the bit.

This creates a reference cycle between the fib6_info and the

exception route, leaking the fib6_info, its nexthop device,

and all per-CPU routes in fib6_nh->rt6i_pcpu, which sta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References