CVE-2026-63969: Linux Kernel IPv6 DoS Vulnerability

CVE-2026-63969 Overview

CVE-2026-63969 is a Linux kernel vulnerability in the IPv6 routing subsystem. The flaw resides in the rt6_fill_node() function and can trigger an infinite loop leading to a CPU stall. The issue was reported by researcher Sashiko and resolved by applying the same class of fix used in commit f8d8ce1b515a for fib6_info_uses_dev(). The root cause involves a race between writers holding tb6_lock that perform list_del_rcu() on rt->fib6_siblings and softirq-side readers that walk the sibling list. Successful triggering results in denial of service through a soft lockup on the affected CPU.

Critical Impact
A local or network-induced condition can cause an infinite loop inside the IPv6 route dump path, producing a CPU stall and denial-of-service on affected Linux kernels.

Affected Products

Linux kernel (IPv6 routing subsystem, net/ipv6/route.c)
Stable kernel branches receiving the referenced backport commits
Distributions shipping vulnerable kernels prior to the fix

Discovery Timeline

2026-07-19 - CVE-2026-63969 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63969

Vulnerability Analysis

The vulnerability is an [Infinite Loop] denial-of-service condition in the Linux kernel IPv6 route handling code. The rt6_fill_node() function walks the fib6_siblings list of a route entry when serializing route information. Writers holding tb6_lock may call list_del_rcu(&rt->fib6_siblings) to detach a route from its sibling ring without waiting for RCU readers to drain. After detachment, the next pointer of the removed entry still references nodes in the old ring, but the walker never traverses back to the sentinel &rt->fib6_siblings. The reader loop therefore never terminates, and the CPU running in softirq context stalls.

Root Cause

The root cause is an unsafe RCU list traversal pattern. fib6_del_route() performs WRITE_ONCE(rt->fib6_nsiblings, 0) before calling list_del_rcu(), but rt6_fill_node() did not consult fib6_nsiblings as a detach signal inside its loop. Concurrent modification therefore left the reader iterating over a stale linkage that no longer routes back to the list head.

Attack Vector

An attacker able to induce concurrent IPv6 route additions, deletions, and route dump operations (for example through netlinkRTM_GETROUTE requests) can race the walker in rt6_fill_node() against fib6_del_route(). When the race is won, the softirq walker enters an unbounded loop. The result is a CPU stall, watchdog warnings, and potential system-wide denial of service depending on IPv6 route churn.

No verified public exploit code is available. The patched behavior adds an inside-loop check on fib6_nsiblings so the reader reliably detects the detach and exits the traversal.

Detection Methods for CVE-2026-63969

Indicators of Compromise

Kernel log messages reporting rcu: INFO: rcu_sched self-detected stall on CPU or watchdog: BUG: soft lockup with stack traces referencing rt6_fill_node or inet6_dump_fib.
Sustained 100% CPU on a single core in softirq context correlated with IPv6 route dump activity.
Repeated netlinkRTM_GETROUTE requests from unprivileged workloads coinciding with kernel stalls.

Detection Strategies

Monitor dmesg and journalctl -k output for soft lockup or RCU stall warnings whose backtraces include IPv6 route functions such as rt6_fill_node, rt6_dump_route, or inet6_dump_fib.
Compare running kernel uname -r and package versions against distribution advisories referencing the stable commits 279853aec9f5, 5e40de719ee7, 9f72412bcf60, b014a63d2f2c, c65b1f60237d, and dc36a04621dc.
Track anomalous per-CPU softirq/NET_RX time in /proc/softirqs on IPv6-heavy hosts.

Monitoring Recommendations

Forward kernel logs to a central platform and alert on soft lockup and RCU stall patterns.
Instrument hosts with perf or bpftrace to sample stacks when a CPU is pinned in softirq, looking for repeated frames in the IPv6 FIB walker.
Baseline the rate of netlink route dump requests and alert on unexpected spikes from unprivileged processes.

How to Mitigate CVE-2026-63969

Immediate Actions Required

Inventory Linux hosts running IPv6 and identify kernels that predate the referenced stable commits.
Apply vendor kernel updates that include the rt6_fill_node() fix once available for your distribution.
Restrict who can issue high-volume IPv6 route dump operations by limiting privileged capabilities such as CAP_NET_ADMIN where feasible.

Patch Information

The fix has been merged into the Linux stable trees. The upstream changes mirror the earlier fix applied to fib6_info_uses_dev() in commit f8d8ce1b515a, adding a fib6_nsiblings check inside the loop as a reliable detach signal. See the stable commits: 279853aec9f5, 5e40de719ee7, 9f72412bcf60, b014a63d2f2c, c65b1f60237d, and dc36a04621dc.

Workarounds

Where IPv6 is not required, disable it via sysctl net.ipv6.conf.all.disable_ipv6=1 to eliminate exposure to the affected code path.
Rate-limit or restrict access to netlink route dump interfaces from untrusted workloads and containers.
Reduce IPv6 route churn on affected hosts until patched kernels are deployed.

bash

# Verify running kernel and check for fixed commit presence in distribution changelog
uname -r
grep -E 'rt6_fill_node|fib6_nsiblings' /usr/share/doc/linux-image-*/changelog.Debian.gz 2>/dev/null

# Optional: disable IPv6 as a temporary mitigation
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1