CVE-2026-93226

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc7

Description A data race exists in the IPv6 implementation of the Linux kernel. The function rt6 nh dump exceptions() uses hlist for each entry() to iterate over RCU-protected exception lists while holding rcu read lock(). However, because it does not hold rt6 exception lock, the function rt6 insert exception() can concurrently add an entry using hlist add head rcu(), leading to a race condition.

Recommendations Update the Linux kernel to version 7.2.0-rc7 or later. As a temporary mitigation, restrict operations that trigger the dumping of route exceptions until the system is updated.