CVE-2026-23200

A kernel BUG (assertion failure) was found in the IPv6 routing code. When a static route is added with the same nexthop as an existing RA-learned route that has a gateway, the RTF_ADDRCONF flag is cleared, making the route ECMP-eligible without being in the fib6_siblings list. This causes a sibling count mismatch that triggers BUG_ON() when adding subsequent ECMP routes.

This crash can be triggered by adding IPv6 routes in specific sequences involving both router-advertisement-learned routes and static routes. A local user with routing configuration privileges (CAP_NET_ADMIN) can trigger the kernel BUG. The impact is denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.