{"id":"CVE-2026-99121","kind":"vulnerability","aliases":["CVE-2026-99121"],"related":[],"title":"Linux kernel: IPv4 route rebalance can divide by zero and crash","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: avoid divide by zero in fib_rebalance\n\nfib_rebalance() computes the total eligible nexthop weight in one pass\nand programs upper bounds in a second pass. A concurrent change to\nignore_routes_with_linkdown can make the first pass return zero while\nthe second pass sees an eligible nexthop, resulting in division by zero.\n\nIf the first pass reports a zero total, set each nexthop upper bound to\n-1 and skip the division. This matches the IPv6 fix in commit\nd2c26c2911dd (\"ipv6: avoid divide by zero in rt6_multipath_rebalance\")\nand preserves the lock-free rebalance path.","summary":"A race between a route-rebalance pass and a change to the linkdown route setting can make the Linux kernel divide by zero while handling multipath IPv4 routes. The sources describe a kernel crash (denial of service), not code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipv4","kernel","linux","multipath-routing","routers"],"not_affected_if":["single-path-routing"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed by your distribution's advisory for CVE-2026-99121\n- unknown whether the sources list affected kernel version ranges","fix":"- Install the kernel build from your distribution or vendor that includes the upstream fix (IPv4 fib_rebalance divide-by-zero guard, mirroring the IPv6 commit d2c26c2911dd)\n- Reboot into the patched kernel\n- unknown which exact kernel versions are fixed, as the sources do not say","status":"open","published_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:34+00:00","updated_at":"2026-10-28T11:37:34+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T11:37:34Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel build from your distribution or vendor that includes the upstream fix (IPv4 fib_rebalance divide-by-zero guard, mirroring the IPv6 commit d2c26c2911dd)\n- Reboot into the patched kernel\n- unknown which exact kernel versions are fixed, as the sources do not say","reach":"local","title":"Linux kernel: IPv4 route rebalance can divide by zero and crash","impact":"low","summary":"A race between a route-rebalance pass and a change to the linkdown route setting can make the Linux kernel divide by zero while handling multipath IPv4 routes. The sources describe a kernel crash (denial of service), not code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","ipv4","multipath-routing","routers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel divide-by-zero crash takes the host down","analyst_note":"Check the NVD entry and the upstream kernel stable commit for affected version ranges and whether a remote trigger exists; the sources give no severity or CVSS.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed by your distribution's advisory for CVE-2026-99121\n- unknown whether the sources list affected kernel version ranges","needs_analyst":true,"not_affected_if":["single-path-routing"],"who_is_affected":"Systems running a Linux kernel with IPv4 multipath routing, where routes are being changed while traffic flows, are the ones that can hit this path. The sources do not say which configurations use the linkdown setting in practice. Hosts with single-path routing or no multipath routes are less likely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":3460,"output_tokens":631,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1':146C '-2026':13A,16A '-99121':14A,17A 'avoid':78C,160C 'bound':99C,144C 'chang':36B,106C 'code':65B 'commit':157C 'comput':87C 'concurr':105C 'crash':11A,60B 'cve':12A,15A 'd2c26c2911dd':158C 'denial':61B 'describ':57B 'divid':7A,47B,79C,161C 'divis':129C,150C 'elig':90C,125C 'execut':66B 'fib':83C,85C 'first':115C,134C 'fix':155C 'follow':72C 'free':173C 'handl':51B 'ignor':108C 'infrastructur':18B 'ipv4':3A,19B,53B,77C 'ipv6':154C,159C 'kernel':2A,20B,46B,59B,70C 'linkdown':39B,111C 'linux':1A,21B,45B,69C 'lock':172C 'lock-fre':171C 'make':43B,113C 'match':152C 'multipath':23B,52B,166C 'multipath-rout':22B 'nexthop':91C,126C,142C 'one':94C 'pass':33B,95C,103C,116C,122C,135C 'path':175C 'preserv':169C 'program':97C 'race':27B 'rebal':5A,32B,84C,86C,167C,174C 'report':136C 'resolv':76C 'result':127C 'return':117C 'rout':4A,24B,31B,40B,54B,109C 'route-rebal':30B 'router':25B 'rt6':165C 'second':102C,121C 'see':123C 'servic':63B 'set':41B,140C 'skip':148C 'sourc':56B 'total':89C,139C 'upper':98C,143C 'vulner':73C 'weight':92C 'zero':9A,49B,81C,118C,131C,138C,163C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IPv4 multipath routing, where routes are being changed while traffic flows, are the ones that can hit this path. The sources do not say which configurations use the linkdown setting in practice. Hosts with single-path routing or no multipath routes are less likely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99121","severity":null,"published_at":"2026-10-28T11:17:31+00:00","modified_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}