In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6_insert_exception() for dying fib6_info. (CVE-2026-98598)

The Linux kernel IPv6 routing subsystem had a flaw where rt6_insert_exception() could insert new exceptions for fib6_info structures that were in the process of being removed (dying). Previously, a flag prevented this insertion, but a recent change replaced that flag with a bit that was only set under certain conditions, allowing new exceptions to be created during fib6_info removal. This caused a reference cycle between fib6_info and exception routes, leaking fib6_info, its nexthop device, and per-CPU routes, which stalled network device unregistration. The fix involves calling fib6_drop_pcpu_from() before rt6_flush_exceptions() to set a fib6_destroying flag and checking this flag in rt6_insert_exception() to prevent new exceptions from being added during destruction. The obsolete FIB6_EXCEPTION_BUCKET_FLUSHED logic can now be removed.

The vulnerability causes resource leaks in the IPv6 routing subsystem by creating reference cycles during route removal. This leads to stalled network device unregistration, which can affect system stability and network functionality. There is no indication of remote code execution or privilege escalation. The impact is primarily a denial of service related to network device management.

A fix has been implemented in the Linux kernel to prevent insertion of new exceptions for fib6_info structures that are being destroyed. Users should update to the fixed kernel version once available. No other mitigation is indicated by the vendor advisory.