{"id":"CVE-2026-98598","kind":"vulnerability","aliases":["CVE-2026-98598"],"related":[],"title":"Linux kernel IPv6: stale route exceptions can leak and stall netdev unregistration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Prevent rt6_insert_exception() for dying fib6_info.\n\nBefore the cited commit, fib6_nh_flush_exceptions() always set\nfrom->exception_bucket_flushed = 1 under rt6_exception_lock to\nprevent rt6_insert_exception() from inserting a new exception\nfor a dying fib6_info.\n\nThe flag was replaced with the FIB6_EXCEPTION_BUCKET_FLUSHED\nbit stored in nh->rt6i_exception_bucket.\n\nThe problem is that now the bit is only set when the bucket\nis not NULL and fib6_nh_flush_exceptions() is called from\nfib6_nh_release() after fib6_ref has already reached zero.\n\nIf rt6_insert_exception() is called while the target fib6_info\nis being removed via fib6_purge_rt(), a new exception could be\ncreated successfully because rt6_flush_exceptions() no longer\nsets the bit.\n\nThis creates a reference cycle between the fib6_info and the\nexception route, leaking the fib6_info, its nexthop device,\nand all per-CPU routes in fib6_nh->rt6i_pcpu, which stalls netdev\nunregistration.\n\n[   34.680602] unregister_netdevice: waiting for gre6 to become free. Usage count = 68\n[   44.920675] unregister_netdevice: waiting for gre6 to become free. Usage count = 68\n[   55.176582] unregister_netdevice: waiting for gre6 to become free. Usage count = 68\n\nLet's call fib6_drop_pcpu_from() before rt6_flush_exceptions(),\nto set fib6_destroying before rt6_exception_lock, and check\nf6i->fib6_destroying in rt6_insert_exception().\n\nNote that FIB6_EXCEPTION_BUCKET_FLUSHED logic is dead and\nwe can clean it up in net-next.","summary":"When an IPv6 route is being removed, the kernel can still add a new route exception to it, creating a reference cycle. The leaked route and its network device are never freed, so unregistering the device hangs.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipv6","linux-kernel","self-hosted"],"not_affected_if":["no-ipv6-routing","no-tunnel-devices"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds in the distribution's advisory\n- Look for kernel log lines `unregister_netdevice: waiting for ... to become free`","fix":"- Install the kernel build from your distribution that includes the upstream fix for this CVE\n- Reboot into the patched kernel; a leaked device cannot be cleared without a reboot","status":"open","published_at":"2026-10-18T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:36+00:00","updated_at":"2026-10-25T05:21:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:21:36Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel build from your distribution that includes the upstream fix for this CVE\n- Reboot into the patched kernel; a leaked device cannot be cleared without a reboot","reach":"local","title":"Linux kernel IPv6: stale route exceptions can leak and stall netdev unregistration","impact":"low","summary":"When an IPv6 route is being removed, the kernel can still add a new route exception to it, creating a reference cycle. The leaked route and its network device are never freed, so unregistering the device hangs.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ipv6","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel leaks network devices and routes, stalling interface unregistration until reboot","analyst_note":"Sources give no fixed kernel version or CVSS; check the NVD entry and the upstream stable commit for the fixed version numbers.","how_to_check":"- `uname -r` and compare against the fixed kernel builds in the distribution's advisory\n- Look for kernel log lines `unregister_netdevice: waiting for ... to become free`","needs_analyst":true,"not_affected_if":["no-ipv6-routing","no-tunnel-devices"],"who_is_affected":"Hosts running an affected Linux kernel that use IPv6 routing with tunnel or GRE devices that get created and removed often. Systems without IPv6 routing or without tunnel devices are unlikely to hit the trigger. Impact is mostly a stalled network device teardown rather than code execution.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000676,"input_tokens":3867,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98598':15A,18A '1':97C '34.680602':237C '44.920675':249C '55.176582':261C '68':248C,260C,272C 'add':38B 'alreadi':165C 'alway':91C 'becom':244C,256C,268C 'bit':127C,140C,201C 'bucket':95C,125C,133C,146C,305C 'call':156C,173C,275C 'check':293C 'cite':85C 'clean':313C 'commit':86C 'could':189C 'count':247C,259C,271C 'cpu':226C 'creat':45B,191C,203C 'cve':13A,16A 'cycl':48B,206C 'dead':309C 'destroy':287C,296C 'devic':55B,62B,221C 'die':80C,114C 'drop':277C 'except':6A,42B,78C,90C,94C,100C,106C,111C,124C,132C,154C,171C,188C,196C,213C,283C,290C,300C,304C 'f6i':294C 'fib6':81C,87C,115C,123C,151C,158C,162C,177C,183C,209C,217C,229C,276C,286C,295C,303C 'flag':118C 'flush':89C,96C,126C,153C,195C,282C,306C 'follow':69C 'free':245C,257C,269C 'freed':58B 'gre6':242C,254C,266C 'hang':63B 'host':26B 'info':82C,116C,178C,210C,218C 'infrastructur':19B 'insert':77C,105C,108C,170C,299C 'ipv6':3A,20B,29B,74C 'kernel':2A,23B,35B,67C 'leak':8A,50B,215C 'let':273C 'linux':1A,22B,66C 'linux-kernel':21B 'lock':101C,291C 'logic':307C 'longer':198C 'net':318C 'net-next':317C 'netdev':11A,235C 'netdevic':239C,251C,263C 'network':54B 'never':57B 'new':40B,110C,187C 'next':319C 'nexthop':220C 'nh':88C,130C,152C,159C,230C 'note':301C 'null':149C 'pcpu':232C,278C 'per':225C 'per-cpu':224C 'prevent':75C,103C 'problem':135C 'purg':184C 'reach':166C 'ref':163C 'refer':47B,205C 'releas':160C 'remov':33B,181C 'replac':120C 'resolv':73C 'rout':5A,30B,41B,51B,214C,227C 'rt':185C 'rt6':76C,99C,104C,169C,194C,281C,289C,298C 'rt6i':131C,231C 'self':25B 'self-host':24B 'set':92C,143C,199C,285C 'stale':4A 'stall':10A,234C 'still':37B 'store':128C 'success':192C 'target':176C 'unregist':60B,238C,250C,262C 'unregistr':12A,236C 'usag':246C,258C,270C 'via':182C 'vulner':70C 'wait':240C,252C,264C 'zero':167C","nicknames":[],"mitigations":[],"who_affected":"Hosts running an affected Linux kernel that use IPv6 routing with tunnel or GRE devices that get created and removed often. Systems without IPv6 routing or without tunnel devices are unlikely to hit the trigger. Impact is mostly a stalled network device teardown rather than code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98598","severity":null,"published_at":"2026-10-18T16:17:12+00:00","modified_at":"2026-10-19T10:19:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}