CVE-2026-97974

A flaw was found in the Linux kernel's IPv6 networking subsystem. This flaw allows a local user to cause a Denial of Service (DoS) by triggering a system crash. The vulnerability is caused by a race condition during concurrent network route modifications and deletions, leading to a null pointer dereference when accessing routing table entries.

A flaw in the Linux kernel's IPv6 routing subsystem allows a local user to cause a denial of service. When IPv6 route deletion via rtnetlink runs without the RTNL lock (RTNL_FLAG_DOIT_UNLOCKED), a race condition can occur between the route lookup in ip6_route_del() and the later acquisition of the routing table lock in __ip6_del_rt_siblings(). If another thread concurrently replaces an ECMP route via RTM_NEWROUTE with NLM_F_REPLACE, the old sibling routes are unlinked and their fib6_node pointer is set to NULL, which is then dereferenced, resulting in a kernel crash. Red Hat rated this flaw as having moderate security impact (CVSS 3.1 score of 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); exploitation requires local access with the ability to modify IPv6 routes (CAP_NET_ADMIN), and only availability is affected.

The vulnerable code, introduced by the upstream change that removed RTNL locking for IPv6 route deletion operations, is present in the Red Hat Enterprise Linux 10.3 and 10.4 kernels and in the Red Hat In-Vehicle OS 2 kernel streams. Earlier Red Hat Enterprise Linux releases, the RHEL 8 and RHEL 9 kernel-rt variants, and the Red Hat CoreOS-based OpenShift releases do not contain the vulnerable code and are therefore not affected. For the affected streams the fix is currently deferred; the residual risk is a local denial of service, constrained by the requirement for local access with network administration privileges (CAP_NET_ADMIN) and the need to win a narrow concurrency window between route lookup and route table locking.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.