Not yet scoredPublished Jul 19, 2026

CVE-2026-63969ipv6: fix possible infinite loop in rt6_fill_node()

Updated under an hour ago (Oct 28, 2026, 11:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6_fill_node() Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings) without waiting for RCU readers; rt->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal. [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 before b014a63d2f2c2c767762b548381882dfb1655529; from 52da02521ede55fb86546c3fffd9377b3261b91f before 279853aec9f58d5cd723e6e5617c1c3337b30383; from 34a949e7a0869dfa31a40416d2a56973fae1807b before c65b1f60237daac7c56c2652e064cc566a45dc81; from d9ccb18f83ea2bb654289b6ecf014fd267cc988b before dc36a04621dcc2447dae428709207810b6c06e14; from d9ccb18f83ea2bb654289b6ecf014fd267cc988b before 5e40de719ee76b8d96e2556ce36dbd3bd07bf37d; from d9ccb18f83ea2bb654289b6ecf014fd267cc988b before 9f72412bcf60144f252b0d6205106abf14344abc; 11edcd026012ac18acee0f1514db3ed1b160fc6f; from 6.1.128 before 6.1.176; and 3 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/b014a63d2f2c2c767762b548381882dfb1655529
https://git.kernel.org/stable/c/279853aec9f58d5cd723e6e5617c1c3337b30383
https://git.kernel.org/stable/c/c65b1f60237daac7c56c2652e064cc566a45dc81
https://git.kernel.org/stable/c/dc36a04621dcc2447dae428709207810b6c06e14
https://git.kernel.org/stable/c/5e40de719ee76b8d96e2556ce36dbd3bd07bf37d
https://git.kernel.org/stable/c/9f72412bcf60144f252b0d6205106abf14344abc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.