CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Prevent rt6 insert exception() for dying fib6 info.

Before the cited commit, fib6 nh flush exceptions() always set from->exception bucket flushed = 1 under rt6 exception lock to prevent rt6 insert exception() from inserting a new exception for a dying fib6 info.

The flag was replaced with the FIB6 EXCEPTION BUCKET FLUSHED bit stored in nh->rt6i exception bucket.

The problem is that now the bit is only set when the bucket is not NULL and fib6 nh flush exceptions() is called from fib6 nh release() after fib6 ref has already reached zero.

If rt6 insert exception() is called while the target fib6 info is being removed via fib6 purge rt(), a new exception could be created successfully because rt6 flush exceptions() no longer sets the bit.

This creates a reference cycle between the fib6 info and the exception route, leaking the fib6 info, its nexthop device, and all per-CPU routes in fib6 nh->rt6i pcpu, which stalls netdev unregistration.

[ 34.680602] unregister netdevice: waiting for gre6 to become free. Usage count = 68 [ 44.920675] unregister netdevice: waiting for gre6 to become free. Usage count = 68 [ 55.176582] unregister netdevice: waiting for gre6 to become free. Usage count = 68

Let's call fib6 drop pcpu from() before rt6 flush exceptions(), to set fib6 destroying before rt6 exception lock, and check f6i->fib6 destroying in rt6 insert exception().

Note that FIB6 EXCEPTION BUCKET FLUSHED logic is dead and we can clean it up in net-next.