In the Linux kernel, the following vulnerability has been resolved:
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the number of siblings. However if the fib6_info has no lwtunnel but the siblings have lwtunnels, the nexthop length is less than it should be, and it will trigger a warning in inet6_rt_notify() as follows:
WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130 ...... Call Trace: <TASK> fib6_add_rt2node+0x685/0xa30 fib6_add+0x96/0x1b0 ip6_route_add+0x50/0xd0 inet6_rtm_newroute+0x97/0xa0 rtnetlink_rcv_msg+0x156/0x3d0 netlink_rcv_skb+0x5a/0x110 netlink_unicast+0x246/0x350 netlink_sendmsg+0x250/0x4c0 sock_sendmsg+0x66/0x70 ___sys_sendmsg+0x7c/0xd0 __sys_sendmsg+0x5d/0xb0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc
This bug can be reproduced by script:
ip -6 addr add 2002::2/64 dev ens2 ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100
for i in 10 20 30 40 50 60 70; do ip link add link ens2 name ipv_$i type ipvlan ip -6 addr add 2002::$i/64 dev ipv_$i ifconfig ipv_$i up done
for i in 10 20 30 40 50 60; do ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1 dev ipv_$i metric 100 done
ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100
This patch fixes it by adding nexthop_len of every siblings using rt6_nh_nlmsg_size().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.102-61.139Upgrade kernel-headersUpgrade kernel-livepatch-5.10.173-154.642Upgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade bpftoolUpgrade perfUpgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernelUpgrade python3-perfUpgrade kernel-livepatch-6.1.19-30.43Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade python3-perf-debuginfo | Oct 16, 2025 | Oct 1, 2025 |
| Debian | — | Upgrade linux | Oct 3, 2025 | Oct 3, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libs | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 1, 2025 |
| Ubuntu | — | Upgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-gcpUpgrade linux-gcp-5.15Upgrade linux-oracle-5.15Upgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gcp-fipsUpgrade linux-raspi-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-intel-iotg-5.15Upgrade linux-ibmUpgrade linux-intel-iot-realtimeUpgrade linux-xilinx-zynqmpUpgrade linux-oracleUpgrade linux-kvmUpgrade linux-nvidia-tegraUpgrade linux-oracle-5.4Upgrade linux-gkeUpgrade linux-riscv-5.15Upgrade linux-fipsUpgrade linux-intel-iotgUpgrade linux-nvidiaUpgrade linux-bluefieldUpgrade linux-azure-fipsUpgrade linux-ibm-5.4Upgrade linux-azure-5.4Upgrade linux-iotUpgrade linux-hwe-5.4Upgrade linux-aws-5.15Upgrade linux-gcp-5.4Upgrade linux-gkeopUpgrade linux-aws-5.4Upgrade linux-awsUpgrade linux-nvidia-tegra-5.15Upgrade linux-lowlatencyUpgrade linux-raspiUpgrade linux-azureUpgrade linux-hwe-5.15Upgrade linux | Oct 10, 2025 | Oct 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Oct 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub