CVE-2026-63968 Overview
CVE-2026-63968 is a denial of service vulnerability in the Linux kernel's IPv6 routing subsystem. The flaw resides in the fib6_select_path() function, where a softirq-side reader can enter an infinite loop while iterating the fib6_siblings list. Writers holding tb6_lock can call list_del_rcu(&first->fib6_siblings) without waiting for RCU readers, leaving first->fib6_siblings.next pointing into a stale ring. The walker then never reaches its terminator. The vulnerability follows the same pattern previously fixed in fib6_info_uses_dev() by commit f8d8ce1b515a. Successful exploitation results in CPU exhaustion and kernel hang, degrading network availability on affected systems.
Critical Impact
A remote, unauthenticated attacker can trigger an infinite loop in the IPv6 routing path, causing sustained CPU exhaustion and network-level denial of service on the Linux host.
Affected Products
- Linux kernel IPv6 stack — fib6_select_path() in net/ipv6/route.c
- Stable kernel branches receiving backported fixes across the referenced commits
- Linux distributions shipping vulnerable kernel builds until backports are integrated
Discovery Timeline
- 2026-07-19 - CVE-2026-63968 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63968
Vulnerability Analysis
The Linux kernel maintains multipath IPv6 routes as a circular list linked through the fib6_siblings field of each fib6_info entry. Readers walk this list in softirq context using RCU semantics, while writers mutate it under the tb6_lock spinlock. The fib6_select_path() function iterates siblings to pick a nexthop for outgoing IPv6 traffic. The routing decision loop terminates when the walker returns to the head entry.
When a writer removes the head entry with list_del_rcu() without a synchronization grace period, the removed node's next pointer still references the pre-removal ring. A concurrent softirq reader that captured this node as its loop terminator will never observe the head again, producing an infinite loop. The condition results in a hard CPU hang on the affected core.
Root Cause
The root cause is unsafe interaction between an RCU-side list walker and a non-RCU-synchronized list detach. fib6_purge_rt() writes first->fib6_nsiblings = 0 via WRITE_ONCE() prior to calling list_del_rcu(). Readers can therefore detect detachment reliably by checking fib6_nsiblings inside the loop, but the pre-patch code did not perform this check.
Attack Vector
An unauthenticated remote attacker can induce routing table churn through crafted IPv6 traffic or route advertisements that cause multipath route insertion and removal while the kernel concurrently forwards IPv6 packets. Reaching the vulnerable code path requires only network reachability with IPv6 enabled; no user interaction or credentials are required. The fix, applied across the referenced stable commits including 0f7b73c3452635de83b8711b31abdda8e49aad7b and 9b9d5bd6e3d4c9cecab5407604b690684b2532d2, introduces an in-loop check on fib6_nsiblings to detect concurrent detach and exit safely.
Detection Methods for CVE-2026-63968
Indicators of Compromise
- Sustained 100% CPU utilization on a single core attributed to softirq (ksoftirqd) processing IPv6 traffic
- Kernel soft lockup messages referencing fib6_select_path or the IPv6 route selection path in dmesg
- IPv6 forwarding stalls or packet loss coinciding with route table changes
Detection Strategies
- Monitor /proc/softirqs and per-CPU utilization for anomalous NET_RX spikes without corresponding traffic increases
- Alert on kernel watchdog or rcu_sched stall warnings that reference IPv6 routing symbols
- Correlate IPv6 route add/delete events with sudden host unresponsiveness on multipath-configured routers
Monitoring Recommendations
- Ingest kernel logs and RCU stall traces into a centralized data lake for cross-host correlation
- Baseline expected ksoftirqd CPU usage and alert on statistical deviation exceeding normal ranges
- Track kernel version inventory across Linux fleets to identify unpatched hosts exposed to the flaw
How to Mitigate CVE-2026-63968
Immediate Actions Required
- Apply the upstream stable kernel updates that include the referenced commits, prioritizing IPv6-facing routers, load balancers, and container hosts
- Inventory Linux systems with IPv6 forwarding or multipath IPv6 routes enabled and schedule reboots for kernel updates
- Validate that vendor-supplied kernel packages have absorbed all six referenced backport commits before considering a host remediated
Patch Information
The upstream fix adds an in-loop detach check using WRITE_ONCE-published fib6_nsiblings to break out of the walker safely. Patched kernels are available across the stable branches identified by the following commits: 0f7b73c3, 3948a7d9, 9b9d5bd6, 9c7da87c, ab9a1096, and c87cd3cb.
Workarounds
- Disable IPv6 multipath routing where operationally feasible until patched kernels are deployed
- Restrict inbound IPv6 route advertisements and rate-limit routing protocol traffic at network boundaries
- Consider disabling IPv6 forwarding on hosts that do not require it by setting net.ipv6.conf.all.forwarding=0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
