CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix dst leak for uncached routes.

ip6 route output flags(), ip6 rt put flags(), and ip6 dst check() detect an uncached route by list empty(&rt->dst.rt uncached), which replaced the static DST NOCACHE flag check in commit a4c2fd7f7891 ("net: remove DST NOCACHE flag").

When a device is unregistered, rt6 uncached list flush dev() unlinks uncached routes tied to the device from rt6 uncached list.

Previously, they were moved to another list with list move() ( list del entry() + list add()), and since commit 98aa546af5e4 ("inet: remove (struct uncached list)->quarantine"), the routes are just unlinked with list del init().

If list del init() runs concurrently, list empty() evaluates to true; ip6 route output flags() calls dst hold safe() incorrectly and ip6 rt put flags() skips ip6 rt put(), leaking dst, and thus dev tied via rt->from as well.

The same race is partially fixed by commit 9a6f0c4d5796 ("dst: fix races in rt6 uncached list del() and rt del uncached list()").

Let's check rt6->dst.rt uncached list instead.

Note that IPv4 does not have the same issue.