CVE-2026-89790 Overview
CVE-2026-89790 is a divide-by-zero flaw in the Linux kernel's IPv6 multipath routing code. The bug lives in rt6_multipath_rebalance() in net/ipv6/route.c and is triggered through a race between route programming and ignore_routes_with_linkdown updates. Because RTM_NEWROUTE runs without the RTNL lock, the first pass that sums eligible nexthop weights can return zero while the second pass still finds an eligible nexthop. The subsequent call to rt6_upper_bound_set() divides by that zero total and crashes the kernel, producing a UBSAN division-overflow and an Oops: divide error.
Critical Impact
A local unprivileged trigger path can panic the kernel through concurrent IPv6 route and sysctl updates, causing a denial-of-service on affected hosts.
Affected Products
- Linux kernel IPv6 stack (net/ipv6/route.c) with multipath route support
- Stable branches receiving the fix commits d2c26c2, f30cf8f, and f82b5db
- Distributions shipping unpatched builds of the above stable kernels
Discovery Timeline
- 2026-09-16 - CVE-2026-89790 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89790
Vulnerability Analysis
The Linux IPv6 subsystem uses rt6_multipath_rebalance() to distribute traffic across multipath nexthops based on configured weights. The function performs two sequential passes over the sibling route list. The first pass computes total as the sum of weights for nexthops considered eligible under the current ignore_routes_with_linkdown policy. The second pass calls rt6_upper_bound_set(), which divides each nexthop's cumulative weight by total to compute an upper bound used by the multipath hash selector.
Because RTM_NEWROUTE handling is RTNL-free for performance, another writer can flip the ignore_routes_with_linkdown sysctl between the two passes. When that flip re-qualifies a nexthop that was excluded during the first pass, total remains zero while the second pass processes at least one eligible entry. The division in rt6_upper_bound_set() at net/ipv6/route.c:4845 then executes with a zero divisor, generating a CPU divide error and kernel oops.
Root Cause
The root cause is a time-of-check to time-of-use (TOCTOU) inconsistency across two passes that read shared state without a common lock. The invariant that the second pass only observes nexthops counted in the first pass no longer holds under the lock-free fast path. This is a classic race condition that surfaces as a numeric divide-by-zero rather than a memory-safety issue.
Attack Vector
An attacker with the ability to issue netlink route messages and toggle the ignore_routes_with_linkdown sysctl on an interface can race the two operations to trigger the crash. On systems where container or network-management workloads program multipath IPv6 routes at high rates, the race can also occur without malicious intent. Successful exploitation leads to a kernel oops and system denial-of-service.
No verified proof-of-concept code has been published. The vulnerability mechanism is documented in the upstream commit messages referenced below.
Detection Methods for CVE-2026-89790
Indicators of Compromise
- Kernel log entries containing UBSAN: division-overflow in net/ipv6/route.c:4845
- Oops: divide error: 0000 [#1] SMP traces with rt6_upper_bound_set and rt6_multipath_rebalance on the call stack
- Unexpected kernel panics correlated with RTM_NEWROUTE netlink activity and IPv6 multipath route changes
Detection Strategies
- Ingest /var/log/kern.log, journald, and dmesg output into centralized logging and alert on divide-error signatures involving net/ipv6/route.c
- Correlate netlink audit events for IPv6 route additions with net.ipv6.conf.*.ignore_routes_with_linkdown sysctl writes occurring in the same time window
- Track kernel crash dumps collected by kdump for stack traces matching rt6_multipath_rebalance frames
Monitoring Recommendations
- Monitor host uptime and unplanned reboot counts on routers, gateways, and Kubernetes nodes that use IPv6 ECMP
- Alert on repeated soft-lockup or oops events on the same host within short intervals
- Baseline the rate of RTM_NEWROUTE messages per host and flag anomalies from unexpected workloads or users
How to Mitigate CVE-2026-89790
Immediate Actions Required
- Apply a stable kernel update that includes the upstream fix commits and reboot affected hosts
- Inventory systems using IPv6 multipath routing and prioritize patching on network-facing gateways and load balancers
- Restrict CAP_NET_ADMIN on multi-tenant hosts to reduce which principals can toggle routing sysctls
Patch Information
The fix short-circuits rt6_multipath_rebalance() when the first pass reports a zero total, skipping the upper-bound calculation entirely. The upstream commits are available at Kernel Patch d2c26c2, Kernel Patch f30cf8f, and Kernel Patch f82b5db. Consumers of long-term stable kernels should track their distribution's advisory for the corresponding backport version.
Workarounds
- Avoid runtime changes to net.ipv6.conf.*.ignore_routes_with_linkdown on hosts that program IPv6 multipath routes
- Where feasible, serialize IPv6 route programming and sysctl updates through a single control plane to eliminate the race window
- Disable IPv6 multipath route usage on non-essential hosts until patched builds are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.