From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C9BC30FF29 for ; Sat, 14 Feb 2026 16:29:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771086598; cv=none; b=YnqQcxxcdCk2ru3v63Dz3dVl5T1+AAbcJth+LI/2kJcWlxYb9/qmWgBFtYsvdACzFGY9GnCSYrFnU3SjATphYkrWLLurKItKeqCYbJqs6uBKijmUm7fW5N0zNCqBBJf+EYqUCFF0poV7tTmAyMAN/dujnNUoV2Mpu9Tu/2Nr0aY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771086598; c=relaxed/simple; bh=98rL9TAgBFi93Gh3nxE5Tu65d7gHiPtjwnbcBZW9qY4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cCnpfcPw28yl69mHV5vkoByheC0x/0IPN/tM6AUAGMjS6BxSySls8UwiMAnqZzq/KWgL6KwNF+epEu2gJaNeCCLxJiiGqIjPIpjtrO3efezx99S9IS7oO8t9XbRiA4/V5ZIRcAzM1SHHqHAL+fQ7uf4X3pe8Z0XknJl2dB5LkMM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wp6mLvhU; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="wp6mLvhU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A20AFC16AAE; Sat, 14 Feb 2026 16:29:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1771086598; bh=98rL9TAgBFi93Gh3nxE5Tu65d7gHiPtjwnbcBZW9qY4=; h=From:To:Cc:Subject:Date:Reply-To:From; b=wp6mLvhU8fL115Hzo9XnLPl3uNEj9SrJqa4QpPjxDkrfCepl0lHJo51iZMSY1qc4U JZn2HMIoHcmEJt6Q951PfqsXKTyboIg2wBwDST58sjUTFkgesosYdJ/roPWRQoOQ0m tnmvKkTyIO8TI4YUYMFI3ml7rILmMc7HsBVN2sEc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-23200: ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF Date: Sat, 14 Feb 2026 17:28:57 +0100 Message-ID: <2026021436-CVE-2026-23200-e35e@gregkh> X-Mailer: git-send-email 2.53.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4396; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=laNEUt+k2i/SHZMBk1XzVCP7yAsaHblm4O5UDxbfoL4=; b=owGbwMvMwCRo6H6F97bub03G02pJDJkTFm05xLLicKnb3tCLUZeu8y6f2i/N/NSNQ0Untkx6w 85pX+epdMSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEwrYzzHd69Pf5rCl6oXEF G5LDM4wKJr75uJFhfoBoYfYLgcV1hZwvVd7VFTq9e+JwHQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6 route. [0] Commit f72514b3c569 ("ipv6: clear RA flags when adding a static route") introduced logic to clear RTF_ADDRCONF from existing routes when a static route with the same nexthop is added. However, this causes a problem when the existing route has a gateway. When RTF_ADDRCONF is cleared from a route that has a gateway, that route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns true. The issue is that this route was never added to the fib6_siblings list. This leads to a mismatch between the following counts: - The sibling count computed by iterating fib6_next chain, which includes the newly ECMP-eligible route - The actual siblings in fib6_siblings list, which does not include that route When a subsequent ECMP route is added, fib6_add_rt2node() hits BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the counts don't match. Fix this by only clearing RTF_ADDRCONF when the existing route does not have a gateway. Routes without a gateway cannot qualify for ECMP anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing RTF_ADDRCONF on them is safe and matches the original intent of the commit. [0]: kernel BUG at net/ipv6/ip6_fib.c:1217! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217 [...] Call Trace: fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946 ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571 inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577 sock_do_ioctl+0xdc/0x300 net/socket.c:1245 sock_ioctl+0x576/0x790 net/socket.c:1366 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The Linux kernel CVE team has assigned CVE-2026-23200 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.120 with commit cb2b0caa8ca93cbe39177516669bf699c74f7041 and fixed in 6.6.124 with commit 50b7c7a255858a85c4636a1e990ca04591153dca Issue introduced in 6.12.63 with commit 03f642caab84bbfd138e74f671bb436186ea7e82 and fixed in 6.12.70 with commit d8143c54ceeba232dc8a13aa0afa14a44b371d93 Issue introduced in 6.18.2 with commit 3e5b25da0b4109a3e063759735e6ec4236ea5a05 and fixed in 6.18.10 with commit b8ad2d53f706aeea833d23d45c0758398fede580 Issue introduced in 6.17.13 with commit 61d88ea0f30c88e4ea98793594943aed8f1fc9ab Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-23200 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv6/ip6_fib.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/50b7c7a255858a85c4636a1e990ca04591153dca https://git.kernel.org/stable/c/d8143c54ceeba232dc8a13aa0afa14a44b371d93 https://git.kernel.org/stable/c/b8ad2d53f706aeea833d23d45c0758398fede580 https://git.kernel.org/stable/c/bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25