---
id: CVE-2026-98598
title: 'ipv6: Prevent rt6_insert_exception() for dying fib6_info.'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: Prevent rt6_insert_exception() for dying fib6_info.

  Before the cited commit, fib6_nh_flush_exceptions() always set
  from->exception_bucket_flushed = 1 under rt6_e…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cc5c073a693fa6ed7a207b0436114f68cce72434 <
    649ffc76ed5483b2caf35ed90d3787538efc4e53
  - >-
    Linux >= cc5c073a693fa6ed7a207b0436114f68cce72434 <
    e03e77071e75ce726d877f0a4349a28b6e1f487a
  - >-
    Linux >= cc5c073a693fa6ed7a207b0436114f68cce72434 <
    0346ec2f080b40d95ed05b853bb9226289e75212
  - Linux 5.3
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:19:11.126Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98598'
references:
  - url: 'https://git.kernel.org/stable/c/649ffc76ed5483b2caf35ed90d3787538efc4e53'
  - url: 'https://git.kernel.org/stable/c/e03e77071e75ce726d877f0a4349a28b6e1f487a'
  - url: 'https://git.kernel.org/stable/c/0346ec2f080b40d95ed05b853bb9226289e75212'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.245Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Prevent rt6_insert_exception() for dying fib6_info.

Before the cited commit, fib6_nh_flush_exceptions() always set
from->exception_bucket_flushed = 1 under rt6_exception_lock to
prevent rt6_insert_exception() from inserting a new exception
for a dying fib6_info.

The flag was replaced with the FIB6_EXCEPTION_BUCKET_FLUSHED
bit stored in nh->rt6i_exception_bucket.

The problem is that now the bit is only set when the bucket
is not NULL and fib6_nh_flush_exceptions() is called from
fib6_nh_release() after fib6_ref has already reached zero.

If rt6_insert_exception() is called while the target fib6_info
is being removed via fib6_purge_rt(), a new exception could be
created successfully because rt6_flush_exceptions() no longer
sets the bit.

This creates a reference cycle between the fib6_info and the
exception route, leaking the fib6_info, its nexthop device,
and all per-CPU routes in fib6_nh->rt6i_pcpu, which stalls netdev
unregistration.

[   34.680602] unregister_netdevice: waiting for gre6 to become free. Usage count = 68
[   44.920675] unregister_netdevice: waiting for gre6 to become free. Usage count = 68
[   55.176582] unregister_netdevice: waiting for gre6 to become free. Usage count = 68

Let's call fib6_drop_pcpu_from() before rt6_flush_exceptions(),
to set fib6_destroying before rt6_exception_lock, and check
f6i->fib6_destroying in rt6_insert_exception().

Note that FIB6_EXCEPTION_BUCKET_FLUSHED logic is dead and
we can clean it up in net-next.

## Affected

- `Linux >= cc5c073a693fa6ed7a207b0436114f68cce72434 < 649ffc76ed5483b2caf35ed90d3787538efc4e53`
- `Linux >= cc5c073a693fa6ed7a207b0436114f68cce72434 < e03e77071e75ce726d877f0a4349a28b6e1f487a`
- `Linux >= cc5c073a693fa6ed7a207b0436114f68cce72434 < 0346ec2f080b40d95ed05b853bb9226289e75212`
- `Linux 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.