CVE-2026-63969 ipv6: fix possible infinite loop in rt6_fill_node()
An attacker can cause a CPU stall and denial of service in the Linux kernel IPv6 routing code via an infinite loop triggered by concurrent route deletions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63969?
CVE-2026-63969 is a denial of service vulnerability in Linux, published on 19 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible infinite loop in rt6_fill_node()
Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()").
Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings) without waiting for RCU readers; rt->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal.
[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev
Which versions are affected by CVE-2026-63969?
How do I fix CVE-2026-63969?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63969 being exploited?
There is no known exploitation of CVE-2026-63969 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63969, DEBIAN-CVE-2026-63969, GHSA-wc3h-5qqj-xwhm, UBUNTU-CVE-2026-63969.