CVE-2026-63969
ipv6: fix possible infinite loop in rt6_fill_node()
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6_fill_node() Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings) without waiting for RCU readers; rt->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal. [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 30, 2026, 2:51 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the kernel fix for rt6_fill_node() race condition.
- Ensure tb6_lock is held during list manipulation.
- Verify RCU synchronization in network routing paths.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63969.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63969 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63969
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63969 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63969 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2', 'lessThan': 'b014a63d2f2c2c767762b548381882dfb1655529', 'versionType': 'git'}, {'status': 'affected', 'version': '52da02521ede55fb86546c3fffd9377b3261b91f', 'lessThan': '279853aec9f58d5cd723e6e5617c1c3337b30383', 'versionType': 'git'}, {'status': 'affected', 'version': '34a949e7a0869dfa31a40416d2a56973fae1807b', 'lessThan': 'c65b1f60237daac7c56c2652e064cc566a45dc81', 'versionType': 'git'}, {'status': 'affected', 'version': 'd9ccb18f83ea2bb654289b6ecf014fd267cc988b', 'lessThan': 'dc36a04621dcc2447dae428709207810b6c06e14', 'versionType': 'git'}, {'status': 'affected', 'version': 'd9ccb18f83ea2bb654289b6ecf014fd267cc988b', 'lessThan': '5e40de719ee76b8d96e2556ce36dbd3bd07bf37d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd9ccb18f83ea2bb654289b6ecf014fd267cc988b', 'lessThan': '9f72412bcf60144f252b0d6205106abf14344abc', 'versionType': 'git'}, {'status': 'affected', 'version': '11edcd026012ac18acee0f1514db3ed1b160fc6f', 'versionType': 'git'}, {'status': 'affected', 'version': '6.1.128', 'lessThan': '6.1.176', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.75', 'lessThan': '6.6.143', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.2', 'lessThan': '6.12.93', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.11.11', 'lessThan': '6.12', 'versionType': 'semver'}], 'programFiles': ['net/ipv6/route.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.13'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.13', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/route.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6_fill_node() Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings) without waiting for RCU readers; rt->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal. [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev Added Reference https://git.kernel.org/stable/c/279853aec9f58d5cd723e6e5617c1c3337b30383 Added Reference https://git.kernel.org/stable/c/5e40de719ee76b8d96e2556ce36dbd3bd07bf37d Added Reference https://git.kernel.org/stable/c/9f72412bcf60144f252b0d6205106abf14344abc Added Reference https://git.kernel.org/stable/c/b014a63d2f2c2c767762b548381882dfb1655529 Added Reference https://git.kernel.org/stable/c/c65b1f60237daac7c56c2652e064cc566a45dc81 Added Reference https://git.kernel.org/stable/c/dc36a04621dcc2447dae428709207810b6c06e14