Race condition in Linux kernel - CVE-2026-98596

Vulnerability identifier: #VU156900

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98596

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause kernel resource leaks that may lead to a denial of service.

The vulnerability exists due to a race condition in IPv6 uncached-route reference handling when route processing occurs concurrently with network device unregistration. A local user can trigger this race to cause incorrect route classification and unbalanced reference counting, leaking destination and associated device references and potentially exhausting kernel resources.

IPv4 is not affected by this issue.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/5045aa25f3790dcdb158a58ac60ccf8da42959aa
• https://git.kernel.org/stable/c/be31fe6333f534155e6b408f1ef6d77974bb41aa
• https://git.kernel.org/stable/c/ed902d5546fb9c142b3216d8eec914fa1bc0aa80
• https://git.kernel.org/stable/c/f9722746df13a8a29103c847ef56b02c11ce0963

• Race condition in Linux kernel ipv6
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more