CVE-2026-97974

A flaw in the Linux kernel's IPv6 routing subsystem allows a local user to cause a denial of service. When IPv6 route deletion via rtnetlink runs without the RTNL lock (RTNL_FLAG_DOIT_UNLOCKED), a race condition can occur between the route lookup in ip6_route_del() and the later acquisition of the routing table lock in __ip6_del_rt_siblings(). If another thread concurrently replaces an ECMP route via RTM_NEWROUTE with NLM_F_REPLACE, the old sibling routes are unlinked and their fib6_node pointer is set to NULL, which is then dereferenced, resulting in a kernel crash. Red Hat rated this flaw as having moderate security impact (CVSS 3.1 score of 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); exploitation requires local access with the ability to modify IPv6 routes (CAP_NET_ADMIN), and only availability is affected.

The vulnerable code, introduced by the upstream change that removed RTNL locking for IPv6 route deletion operations, is present in the Red Hat Enterprise Linux 10.3 and 10.4 kernels and in the Red Hat In-Vehicle OS 2 kernel streams. Earlier Red Hat Enterprise Linux releases, the RHEL 8 and RHEL 9 kernel-rt variants, and the Red Hat CoreOS-based OpenShift releases do not contain the vulnerable code and are therefore not affected. For the affected streams the fix is currently deferred; the residual risk is a local denial of service, constrained by the requirement for local access with network administration privileges (CAP_NET_ADMIN) and the need to win a narrow concurrency window between route lookup and route table locking.