{"id":"CVE-2026-98596","kind":"vulnerability","aliases":["CVE-2026-98596"],"related":[],"title":"Linux kernel: IPv6 uncached route race leaks network device references","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix dst leak for uncached routes.\n\nip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check()\ndetect an uncached route by list_empty(&rt->dst.rt_uncached),\nwhich replaced the static DST_NOCACHE flag check in commit\na4c2fd7f7891 (\"net: remove DST_NOCACHE flag\").\n\nWhen a device is unregistered, rt6_uncached_list_flush_dev()\nunlinks uncached routes tied to the device from rt6_uncached_list.\n\nPreviously, they were moved to another list with list_move()\n(__list_del_entry() + list_add()), and since commit 98aa546af5e4\n(\"inet: remove (struct uncached_list)->quarantine\"), the routes\nare just unlinked with list_del_init().\n\nIf list_del_init() runs concurrently, list_empty() evaluates to\ntrue; ip6_route_output_flags() calls dst_hold_safe() incorrectly\nand ip6_rt_put_flags() skips ip6_rt_put(), leaking dst, and thus\ndev tied via rt->from as well.\n\nThe same race is partially fixed by commit 9a6f0c4d5796 (\"dst:\nfix races in rt6_uncached_list_del() and rt_del_uncached_list()\").\n\nLet's check rt6->dst.rt_uncached_list instead.\n\nNote that IPv4 does not have the same issue.","summary":"When a network device is unregistered, a race in the IPv6 routing code can leave uncached route objects alive, leaking the destination entry and the device tied to it. The sources do not describe an attacker-triggered memory corruption or code execution path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipv6","linux-kernel","runtime","self-hosted"],"not_affected_if":["ipv4-only","ipv6-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:37+00:00","updated_at":"2026-10-25T05:21:37+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:21:37Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: IPv6 uncached route race leaks network device references","impact":"low","summary":"When a network device is unregistered, a race in the IPv6 routing code can leave uncached route objects alive, leaking the destination entry and the device tied to it. The sources do not describe an attacker-triggered memory corruption or code execution path.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ipv6","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; a leaked device reference can block device unregistration","analyst_note":"Find the affected and fixed kernel versions and the upstream fix commit from the NVD or kernel.org stable entry for CVE-2026-98596.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["ipv6-disabled","ipv4-only"],"who_is_affected":"Systems running a Linux kernel with IPv6 enabled that frequently create and unregister network devices, such as container hosts, VPN gateways or hosts with hot-plugged interfaces. The sources do not say which kernel versions are affected or which fixed versions exist.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000599,"input_tokens":3711,"output_tokens":456,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98596':13A,16A '98aa546af5e4':163C '9a6f0c4d5796':227C 'a4c2fd7f7891':118C 'add':159C 'aliv':43B 'anoth':150C 'attack':61B 'attacker-trigg':60B 'call':194C 'check':97C,115C,243C 'code':37B,66B 'commit':117C,162C,226C 'concurr':184C 'corrupt':64B 'cve':11A,14A 'del':156C,177C,181C,235C,238C 'describ':58B 'destin':46B 'detect':98C 'dev':133C,212C 'devic':9A,28B,50B,126C,140C 'dst':81C,96C,112C,121C,195C,209C,228C 'dst.rt':106C,245C 'empti':104C,186C 'entri':47B,157C 'evalu':187C 'execut':67B 'fix':80C,224C,229C 'flag':89C,93C,114C,123C,193C,203C 'flush':132C 'follow':74C 'hold':196C 'host':24B 'incorrect':198C 'inet':164C 'init':178C,182C 'instead':248C 'ip6':86C,90C,95C,190C,200C,205C 'ipv4':251C 'ipv6':3A,17B,35B,79C 'issu':257C 'kernel':2A,20B,72C 'leak':7A,44B,82C,208C 'leav':39B 'let':241C 'linux':1A,19B,71C 'linux-kernel':18B 'list':103C,131C,144C,151C,153C,155C,158C,168C,176C,180C,185C,234C,240C,247C 'memori':63B 'move':148C,154C 'net':119C 'network':8A,27B 'nocach':113C,122C 'note':249C 'object':42B 'output':88C,192C 'partial':223C 'path':68B 'previous':145C 'put':92C,202C,207C 'quarantin':169C 'race':6A,32B,221C,230C 'refer':10A 'remov':120C,165C 'replac':109C 'resolv':78C 'rout':5A,36B,41B,85C,87C,101C,136C,171C,191C 'rt':91C,105C,201C,206C,215C,237C 'rt6':129C,142C,232C,244C 'run':183C 'runtim':21B 'safe':197C 'self':23B 'self-host':22B 'sinc':161C 'skip':204C 'sourc':55B 'static':111C 'struct':166C 'thus':211C 'tie':51B,137C,213C 'trigger':62B 'true':189C 'uncach':4A,40B,84C,100C,107C,130C,135C,143C,167C,233C,239C,246C 'unlink':134C,174C 'unregist':30B,128C 'via':214C 'vulner':75C 'well':218C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IPv6 enabled that frequently create and unregister network devices, such as container hosts, VPN gateways or hosts with hot-plugged interfaces. The sources do not say which kernel versions are affected or which fixed versions exist.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98596","severity":null,"published_at":"2026-10-18T16:17:12+00:00","modified_at":"2026-10-19T10:19:20+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}