CVE-2026-93226

CVE CVE-2026-93226EUVD EUVD-2026-86231Published 2026-09-24T15:28:55.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over RCU-protected exception lists. The caller holds rcu_read_lock(), but does not hold rt6_exception_lock, so rt6_insert_exception() can concurrently add an entry with hlist_add_head_rcu(). KCSAN reports this race (irrelevant details omitted): ================================================================== BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5: rt6_insert_exception+0x3bb/0x760 __ip6_rt_update_pmtu+0x4fe/0x750 ip6_sk_update_pmtu+0x19a/0x3b0 udpv6_err+0x3ff/0x800 icmpv6_notify+0x1e1/0x440 icmpv6_rcv+0x8c0/0xab0 ip6_protocol_deliver_rcu+0x616/0x840 ip6_input_finish+0xb9/0x160 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14: rt6_nh_dump_exceptions+0xb3/0x260 rt6_dump_route+0x53e/0x5f0 fib6_dump_node+0x6d/0xf0 fib6_walk_continue+0x290/0x2d0 fib6_dump_table+0x28d/0x360 inet6_dump_fib+0x37d/0x620 rtnl_dumpit+0x7b/0xd0 netlink_dump+0x3ae/0x7e0 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f 4 locks held by dumper/549: ... #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620 #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360 #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0 value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100 Reported by Kernel Concurrency Sanitizer on: CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted 7.2.0-rc7-virtme #38 PREEMPT(lazy) ... Use hlist_for_each_entry_rcu() to safely iterate over the exception list.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <6bd3f94ed858f2d072627546b4cdf712b0f8ea88; 5.3; patch: 6.1.188; patch: 7.3-rc1; 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <a602cd128d17a793e12888edc8eda85821ede7e1; 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <47cdab0d51aaa9bd85f8e4904585bd5bd4df4488; patch: 0; 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <3665abc3d2ae8a78cb67f858e848481432ec75db; patch: 5.15.221; patch: 6.6.157; patch: 6.12.109; 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <dffbfb3117138e8e0e09d05f507bd36ca1f696e5; patch: 5.10.270; 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <f6b1b15848fd91fe122dac0d19d3d666e35075b6; patch: 7.2.4; 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <eda56ee17713f9dd834b922f7dbfa2e25fa6358c; patch: 6.18.50; 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <9c6be625e1a7258e845d6193b3b6b084a00f8e9e

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.