CVE-2026-93226
Received Received - Intake

Race Condition in Linux Kernel IPv6 Route Exception Handling

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over RCU-protected exception lists. The caller holds rcu_read_lock(), but does not hold rt6_exception_lock, so rt6_insert_exception() can concurrently add an entry with hlist_add_head_rcu(). KCSAN reports this race (irrelevant details omitted): ================================================================== BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5: rt6_insert_exception+0x3bb/0x760 __ip6_rt_update_pmtu+0x4fe/0x750 ip6_sk_update_pmtu+0x19a/0x3b0 udpv6_err+0x3ff/0x800 icmpv6_notify+0x1e1/0x440 icmpv6_rcv+0x8c0/0xab0 ip6_protocol_deliver_rcu+0x616/0x840 ip6_input_finish+0xb9/0x160 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14: rt6_nh_dump_exceptions+0xb3/0x260 rt6_dump_route+0x53e/0x5f0 fib6_dump_node+0x6d/0xf0 fib6_walk_continue+0x290/0x2d0 fib6_dump_table+0x28d/0x360 inet6_dump_fib+0x37d/0x620 rtnl_dumpit+0x7b/0xd0 netlink_dump+0x3ae/0x7e0 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f 4 locks held by dumper/549: ... #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620 #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360 #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0 value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100 Reported by Kernel Concurrency Sanitizer on: CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted 7.2.0-rc7-virtme #38 PREEMPT(lazy) ... Use hlist_for_each_entry_rcu() to safely iterate over the exception list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93226
EUVD
EUVD-2026-86231

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel From 7.2.0-rc7-virtme (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's IPv6 routing code. It occurs when two operations access the same data structure concurrently without proper synchronization. The rt6_nh_dump_exceptions function iterates over route exceptions while holding an RCU read lock, but another function rt6_insert_exception can modify the same list concurrently using RCU operations. This violates safe concurrent access patterns.

Detection Guidance

This vulnerability is a race condition in the Linux kernel's IPv6 route exception handling. Detection requires kernel-level monitoring for data races in the IPv6 subsystem. Use KCSAN (Kernel Concurrency Sanitizer) to detect such races during runtime. Enable KCSAN in your kernel configuration and monitor kernel logs for data race reports involving rt6_insert_exception or rt6_nh_dump_exceptions functions.

Commands to check for kernel taints or warnings: dmesg | grep -i 'KCSAN\|race\|rt6_insert_exception\|rt6_nh_dump_exceptions'. If KCSAN is enabled, it will report data races in these functions during operation.

Impact Analysis

This vulnerability could cause system instability or crashes due to memory corruption or use-after-free conditions. It might lead to incorrect routing decisions, network connectivity issues, or privilege escalation if exploited. Systems running vulnerable Linux kernel versions could experience kernel panics or unexpected behavior during network operations.

Mitigation Strategies

Apply the kernel patch that replaces hlist_for_each_entry() with hlist_for_each_entry_rcu() in the IPv6 route exception handling code. This patch ensures safe iteration over RCU-protected exception lists. Update your Linux kernel to a version containing this fix.

If a patched kernel is not immediately available, consider temporarily disabling IPv6 route exception handling if it is not critical to your operations. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart