CVE-2026-63969

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker could trigger an infinite loop within the rt6_fill_node() function. This occurs when a writer removes an entry from a list without proper synchronization, causing a softirq-side process to continuously loop. The consequence of this vulnerability is a CPU stall, leading to a Denial of Service (DoS) for the system.

This vulnerability is rated as Moderate impact because exploitation requires local system access to trigger concurrent IPv6 routing modifications and queries, restricting the blast radius to a localized denial of service. While standard enterprise installations enable IPv6 networking by default, triggering this race condition requires specific timing between route deletions and netlink queries that causes a kernel hang, without compromising system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.