---
id: CVE-2026-93226
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: use RCU iterator to dump route exceptions

  rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
  RCU-protected exception lists
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: use RCU iterator to dump route exceptions

  rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
  RCU-protected exception lists. The caller holds rc…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    dffbfb3117138e8e0e09d05f507bd36ca1f696e5
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    6bd3f94ed858f2d072627546b4cdf712b0f8ea88
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    9c6be625e1a7258e845d6193b3b6b084a00f8e9e
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    3665abc3d2ae8a78cb67f858e848481432ec75db
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    eda56ee17713f9dd834b922f7dbfa2e25fa6358c
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    a602cd128d17a793e12888edc8eda85821ede7e1
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    f6b1b15848fd91fe122dac0d19d3d666e35075b6
  - >-
    Linux >= 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <
    47cdab0d51aaa9bd85f8e4904585bd5bd4df4488
  - Linux 5.3
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:17.973'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93226'
references:
  - url: 'https://git.kernel.org/stable/c/3665abc3d2ae8a78cb67f858e848481432ec75db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/47cdab0d51aaa9bd85f8e4904585bd5bd4df4488'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6bd3f94ed858f2d072627546b4cdf712b0f8ea88'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9c6be625e1a7258e845d6193b3b6b084a00f8e9e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a602cd128d17a793e12888edc8eda85821ede7e1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dffbfb3117138e8e0e09d05f507bd36ca1f696e5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eda56ee17713f9dd834b922f7dbfa2e25fa6358c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f6b1b15848fd91fe122dac0d19d3d666e35075b6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T15:45:56.663Z'
epss: 0.00176
epssPercentile: 0.06424
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU iterator to dump route exceptions

rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
RCU-protected exception lists. The caller holds rcu_read_lock(), but does
not hold rt6_exception_lock, so rt6_insert_exception() can concurrently
add an entry with hlist_add_head_rcu().

KCSAN reports this race (irrelevant details omitted):

  ==================================================================
  BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions

  write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:
    rt6_insert_exception+0x3bb/0x760
    __ip6_rt_update_pmtu+0x4fe/0x750
    ip6_sk_update_pmtu+0x19a/0x3b0
    udpv6_err+0x3ff/0x800
    icmpv6_notify+0x1e1/0x440
    icmpv6_rcv+0x8c0/0xab0
    ip6_protocol_deliver_rcu+0x616/0x840
    ip6_input_finish+0xb9/0x160
    ...
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

  read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:
    rt6_nh_dump_exceptions+0xb3/0x260
    rt6_dump_route+0x53e/0x5f0
    fib6_dump_node+0x6d/0xf0
    fib6_walk_continue+0x290/0x2d0
    fib6_dump_table+0x28d/0x360
    inet6_dump_fib+0x37d/0x620
    rtnl_dumpit+0x7b/0xd0
    netlink_dump+0x3ae/0x7e0
    ...
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

  4 locks held by dumper/549:
    ...
    #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620
    #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360
    #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0

  value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100

  Reported by Kernel Concurrency Sanitizer on:
  CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted
  7.2.0-rc7-virtme #38 PREEMPT(lazy)
  ...

Use hlist_for_each_entry_rcu() to safely iterate over the exception list.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.