SB20261022174 - Race condition in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98596)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel resource leaks that may lead to a denial of service.

The vulnerability exists due to a race condition in IPv6 uncached-route reference handling when route processing occurs concurrently with network device unregistration. A local user can trigger this race to cause incorrect route classification and unbalanced reference counting, leaking destination and associated device references and potentially exhausting kernel resources.

IPv4 is not affected by this issue.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5045aa25f3790dcdb158a58ac60ccf8da42959aa
• https://git.kernel.org/stable/c/be31fe6333f534155e6b408f1ef6d77974bb41aa
• https://git.kernel.org/stable/c/ed902d5546fb9c142b3216d8eec914fa1bc0aa80
• https://git.kernel.org/stable/c/f9722746df13a8a29103c847ef56b02c11ce0963