CVE-2026-63968 ipv6: fix possible infinite loop in fib6_select_path()
An attacker can trigger an infinite loop in the Linux kernel IPv6 path selection, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63968?
CVE-2026-63968 is a high-severity denial of service vulnerability in Linux, published on 19 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible infinite loop in fib6_select_path()
Found while auditing the same pattern Sashiko reported in rt6_fill_node() [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()").
Writers holding tb6_lock can list_del_rcu(&first->fib6_siblings) without waiting for RCU readers; first->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &first->fib6_siblings as its terminator. fib6_purge_rt() always WRITE_ONCE()s first->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal.
[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev
Weakness: CWE-835
Which versions are affected by CVE-2026-63968?
How do I fix CVE-2026-63968?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63968 being exploited?
There is no known exploitation of CVE-2026-63968 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63968, DEBIAN-CVE-2026-63968, GHSA-c2hg-pgqh-6wp2, UBUNTU-CVE-2026-63968.