CVE-2025-38588

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent infinite loop in rt6_nlmsg_size()

While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place:

list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); }

This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list.

Restart the loop if f6i->fib6_nsiblings is zero.

The bug in rt6_nlmsg_size() could cause an infinite loop when iterating over IPv6 route siblings, leading to CPU soft lockups and denial of service. It does not expose or alter data, so confidentiality and integrity remain unaffected. A local user with privileges to manipulate IPv6 routing tables (e.g. via netlink with CAP_NET_ADMIN) could potentially trigger this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.