CVE-2026-98598

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker or network traffic triggering route exceptions while an IPv6 route is being removed can cause a circular reference leak. This failure to release resources prevents network devices from unregistering, resulting in stalled operations and a Denial of Service (DoS).

This flaw is rated as Moderate severity because successful exploitation requires highly specific race conditions during IPv6 route removal and exception generation, restricting the impact to a local denial-of-service condition without compromising system integrity or confidentiality. In typical Red Hat Enterprise Linux and OpenShift environments, routine network traffic does not trigger this race unless routing tables or interfaces are actively torn down under concurrent traffic. Consequently, systems with static routing configurations and stable network interfaces face minimal operational exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.