CVE-2026-99121 ipv4: avoid divide by zero in fib_rebalance
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99121?
CVE-2026-99121 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: avoid divide by zero in fib_rebalance
fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_routes_with_linkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero.
If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6_multipath_rebalance") and preserves the lock-free rebalance path.
Which versions are affected by CVE-2026-99121?
How do I fix CVE-2026-99121?
Upgrade to a fixed version.
Is CVE-2026-99121 being exploited?
There is no known exploitation of CVE-2026-99121 in the wild and no public exploit code.
Sources
Also known as AZL-111221, BELL-CVE-2026-99121, DEBIAN-CVE-2026-99121, GHSA-6q9r-cqw9-q9q4, UBUNTU-CVE-2026-99121.