In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. (CVE-2026-98596)

The Linux kernel's IPv6 routing functions ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check() detect uncached routes by checking if the list rt->dst.rt_uncached is empty, replacing a previous static flag check. When a network device is unregistered, the function rt6_uncached_list_flush_dev() unlinks uncached routes tied to that device from the rt6_uncached_list. Previously, routes were moved between lists, but since a commit removing the quarantine list, routes are unlinked with list_del_init(). If list_del_init() runs concurrently, list_empty() may incorrectly evaluate to true, causing ip6_route_output_flags() to call dst_hold_safe() incorrectly and ip6_rt_put_flags() to skip ip6_rt_put(), resulting in a leak of dst objects and associated devices. A partial fix was made in a prior commit addressing races in rt6_uncached_list_del() and rt_del_uncached_list(). The current fix involves checking rt6->dst.rt_uncached_list directly to avoid the race. IPv4 routing code does not have this issue.

The vulnerability causes a memory leak of destination cache objects and associated network device references in the IPv6 routing subsystem of the Linux kernel. This leak occurs due to a race condition during device unregistration and can lead to resource exhaustion over time. There is no indication of direct code execution or privilege escalation from the provided data. IPv4 routing is unaffected.

A fix for this vulnerability has been implemented in the Linux kernel by modifying the detection of uncached routes and correcting the race condition in list handling. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No alternative mitigations or workarounds are described.