CVE-2026-89790 ipv6: avoid divide by zero in rt6_multipath_rebalance
A race condition in the Linux kernel IPv6 routing code can cause a divide-by-zero error, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89790?
CVE-2026-89790 is a denial of service vulnerability in Linux, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: avoid divide by zero in rt6_multipath_rebalance
rt6_multipath_rebalance() calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTM_NEWROUTE is RTNL-free, a concurrent ignore_routes_with_linkdown update can make the first pass return zero while the second sees an eligible nexthop, causing rt6_upper_bound_set() to divide by zero.
UBSAN: division-overflow in net/ipv6/route.c:4845:17 Oops: divide error: 0000 [#1] SMP KASAN NOPTI rt6_upper_bound_set() net/ipv6/route.c:4845 rt6_multipath_rebalance() fib6_add_rt2node() ip6_route_multipath_add() inet6_rtm_newroute()
Skip upper-bound calculation when the first pass reports a zero total. This respects the lock-free performance considerations here and solves insecure scenarios.
Which versions are affected by CVE-2026-89790?
How do I fix CVE-2026-89790?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89790 being exploited?
There is no known exploitation of CVE-2026-89790 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89790, DEBIAN-CVE-2026-89790, GHSA-8437-c9wr-2522, UBUNTU-CVE-2026-89790.