CVE-2026-63968

A flaw was found in the Linux kernel's IPv6 networking stack. A local attacker could trigger an infinite loop within the fib6_select_path() function. This occurs when a writer removes an entry from a list without proper synchronization with readers, causing the list traversal to never terminate. This vulnerability can lead to a denial of service (DoS) condition, making the system unresponsive.

An IPv6 routing race can make fib6_select_path loop indefinitely when an RCU reader walks a fib6_siblings ring while a writer removes the first sibling without waiting for readers. The stale next pointer can keep the softirq side walker inside the old ring and prevent it from reaching the expected list terminator, causing a CPU soft lockup. For the CVSS the PR:N is used in the paranoid score because packet processing can reach this path without local privileges if an attacker can send IPv6 traffic to a routing target during concurrent nexthop churn. The reliable base case is more restricted because creating the required route churn usually needs local routing control. The issue is network reachable only under specific routing and churn conditions, so AC:H is kept. Impact is denial of service only through CPU lockup and routing path stall.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.