CVE-2026-97940

A flaw was found in the Linux kernel's IPv6 routing subsystem. A race condition during route iteration termination can allow an internal routing table walker structure to remain on an active list after its associated memory is released. A local user could exploit this flaw during concurrent route deletions, triggering a use-after-free condition that can result in a Denial of Service (DoS) via a system crash or potential privilege escalation.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and precise timing to win a race condition. The issue resides in the kernel's IPv6 route traversal logic when handling iterator termination, which can lead to memory corruption if routes are modified concurrently. While local authenticated users can interact with route iterators through standard interfaces such as the proc filesystem, achieving successful privilege escalation remains complex due to the narrow race window and modern kernel memory protections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.