CVE-2026-46099: Linux Kernel Race Condition Vulnerability

CVE-2026-46099 Overview

CVE-2026-46099 is a use-after-free vulnerability in the Linux kernel IPv6 networking stack. The flaw resides in the Segment Routing IPv6 (SRv6) and Routing Protocol for Low-Power and Lossy Networks (RPL) lightweight tunnel input paths. Specifically, seg6_input_core() and rpl_input() invoke ip6_route_input(), which sets a NOREF destination entry on the socket buffer. The code then passes this entry to dst_cache_set_ip6(), which calls dst_hold() unconditionally. On PREEMPT_RT kernels, a concurrent FIB lookup on a shared nexthop can release the underlying per-CPU route between the lookup and the caching operation, leading to use-after-free.

Critical Impact
A race condition between ksoftirqd and a higher-priority task on the same CPU can dereference a freed pcpu_rt destination, producing kernel warnings or use-after-free conditions exploitable for denial of service or memory corruption.

Affected Products

Linux kernel IPv6 subsystem (net/ipv6/seg6_iptunnel.c)
Linux kernel IPv6 subsystem (net/ipv6/rpl_iptunnel.c)
PREEMPT_RT-enabled Linux kernel builds without PREEMPT_RT_NEEDS_BH_LOCK

Discovery Timeline

2026-05-27 - CVE-2026-46099 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46099

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] leading to a use-after-free [CWE-416] in the IPv6 lightweight tunnel input handlers. Both seg6_input_core() and rpl_input() perform a routing lookup via ip6_route_input() and then attempt to cache the resulting destination entry. The lookup path uses the RT6_LOOKUP_F_DST_NOREF flag, meaning the returned dst is attached to the skb without incrementing its reference count.

When the input handler subsequently calls dst_cache_set_ip6(), the helper invokes dst_hold() to take a reference. This sequence is unsafe on preemptible kernels because the unreferenced dst can be released between the lookup and the cache insertion. The defect affects forwarding and reception paths that traverse SRv6 or RPL encapsulation.

Root Cause

The root cause is incorrect lifecycle management of a NOREF destination cache entry. The per-CPU route (pcpu_rt) returned by rt6_make_pcpu_route() carries a refcount of 1 when first installed in the fib6_nh.rt6i_pcpu slot. A concurrent FIB lookup triggered by rt_genid_bump_ipv6() can detect a stale sernum, perform an xchg to clear the slot, and call dst_release() on the previous entry. This drops the refcount to zero and frees the route while the original handler still holds a NOREF pointer in the skb.

Attack Vector

Exploitation requires a PREEMPT_RT kernel without PREEMPT_RT_NEEDS_BH_LOCK and a system configured with SRv6 or RPL lightweight tunnels. An attacker must induce concurrent FIB updates or output-path lookups that share a nexthop with the input path. Shared nexthop objects are the practical trigger because two routes pointing to the same nhid share the same fib6_nh and its rt6i_pcpu entry. The race window opens between ip6_route_input() returning the NOREF dst and dst_cache_set_ip6() taking its hold.

No verified public exploit code is available. The patch fixes the issue by calling skb_dst_force() after ip6_route_input() to convert the NOREF dst into a refcounted one before caching. Refer to the upstream commits referenced below for the exact source-level change.

Detection Methods for CVE-2026-46099

Indicators of Compromise

Kernel WARN or BUG traces referencing dst_hold, dst_cache_set_ip6, seg6_input_core, or rpl_input in dmesg or journalctl -k output.
Use-after-free reports from KASAN-enabled kernels pointing to freed pcpu_rt objects in the IPv6 route cache.
Unexplained kernel panics or soft lockups on PREEMPT_RT systems handling SRv6 or RPL encapsulated traffic.

Detection Strategies

Audit running kernel configuration for CONFIG_PREEMPT_RT=y combined with active seg6 or rpl lwtunnel routes via ip -6 route show.
Enable KASAN on test or canary nodes to surface the use-after-free condition before production impact occurs.
Correlate kernel crash dumps and vmcore analysis with stack frames involving dst_cache_set_ip6 and IPv6 lwtunnel input functions.

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on WARN_ON or general protection fault events that include IPv6 routing symbols.
Track kernel version inventory across PREEMPT_RT fleets and flag hosts lacking the upstream fix commits.
Monitor uptime anomalies and reboot frequency on routers, edge gateways, and industrial systems using SRv6 or RPL tunneling.

How to Mitigate CVE-2026-46099

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce skb_dst_force() in seg6_input_core() and rpl_input() before dst_cache_set_ip6().
Inventory all Linux hosts running PREEMPT_RT kernels and identify those configured with SRv6 or RPL lwtunnels.
Prioritize patching for systems exposed to untrusted IPv6 traffic or operating in multi-tenant routing environments.

Patch Information

The fix is distributed across multiple stable branches. Apply the relevant commit for your kernel tree: Kernel Git Commit 52f9db6, Kernel Git Commit 6bd1792, Kernel Git Commit 9dd5481, Kernel Git Commit b778b6d, and Kernel Git Commit f9c52a6. Each commit calls skb_dst_force() after ip6_route_input() so the cached destination holds a real reference.

Workarounds

Remove SRv6 and RPL lightweight tunnel routes where the encapsulation is not operationally required, eliminating the vulnerable code path.
Switch to a non-PREEMPT_RT kernel build on hosts that do not require real-time scheduling guarantees.
Avoid sharing nexthop objects across multiple routes that traverse seg6 or rpl encapsulation, reducing the race window opportunity.

bash

# Verify whether PREEMPT_RT is enabled and inspect seg6/rpl tunnel routes
uname -a | grep -i PREEMPT_RT
grep CONFIG_PREEMPT_RT /boot/config-$(uname -r)
ip -6 route show | grep -E 'encap (seg6|rpl)'