LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23200: ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6 route. [0] Commit f72514b3c569 ("ipv6: clear RA flags when adding a static route") introduced logic to clear RTF_ADDRCONF from existing routes when a static route with the same nexthop is added. However, this causes a problem when the existing route has a gateway. When RTF_ADDRCONF is cleared from a route that has a gateway, that route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns true. The issue is that this route was never added to the fib6_siblings list. This leads to a mismatch between the following counts: - The sibling count computed by iterating fib6_next chain, which includes the newly ECMP-eligible route - The actual siblings in fib6_siblings list, which does not include that route When a subsequent ECMP route is added, fib6_add_rt2node() hits BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the counts don't match. Fix this by only clearing RTF_ADDRCONF when the existing route does not have a gateway. Routes without a gateway cannot qualify for ECMP anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing RTF_ADDRCONF on them is safe and matches the original intent of the commit. [0]: kernel BUG at net/ipv6/ip6_fib.c:1217! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217 [...] Call Trace: <TASK> fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946 ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571 inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577 sock_do_ioctl+0xdc/0x300 net/socket.c:1245 sock_ioctl+0x576/0x790 net/socket.c:1366 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel IPv6 routing flaw that can hit a kernel BUG when certain static IPv6 route additions interact with existing gateway routes. The documented impact is a kernel crash condition found by syzkaller, not data theft or remote compromise. Public evidence does not show active exploitation.

Executive priority

Treat as a reliability and availability issue for Linux systems using IPv6 routing. Patch through normal kernel maintenance, with higher priority for infrastructure where a kernel crash would affect critical services.

Technical view

The bug involves clearing RTF_ADDRCONF on an existing IPv6 route with a gateway, making it newly ECMP-eligible without adding it to fib6_siblings. Later ECMP route insertion can make fib6_add_rt2node() detect mismatched sibling counts and hit a BUG_ON.

Likely exposure

Exposure is limited to Linux kernels containing the vulnerable IPv6 route-handling logic. The source describes route addition through IPv6 routing code and an ioctl path, but does not prove remote reachability or unprivileged exploitation.

Exploitation context

The only exploitation evidence provided is a syzkaller report causing a kernel BUG during IPv6 route addition. KEV status is false, and the bundle provides no public in-the-wild exploitation claim.

Researcher notes

The root cause is an ECMP eligibility/list-membership mismatch after RTF_ADDRCONF is cleared on gateway routes. The source names the intended fix: only clear RTF_ADDRCONF when the existing route does not have a gateway.

Mitigation direction

  • Apply Linux stable kernel updates containing the referenced fixes.
  • Prioritize systems using IPv6 routing, static routes, or ECMP.
  • Check distribution advisories for backported kernel fixes.
  • Avoid ad hoc kernel patching unless aligned with vendor guidance.

Validation and detection

  • Inventory Linux kernel versions across exposed servers and network appliances.
  • Check whether deployed kernels include the referenced stable commits.
  • Review systems using IPv6 static route or ECMP configuration.
  • Confirm vendor advisory status before closing remediation tickets.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23200 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcb2b0caa8ca93cbe39177516669bf699c74f7041, 03f642caab84bbfd138e74f671bb436186ea7e82, 3e5b25da0b4109a3e063759735e6ec4236ea5a05, f72514b3c5698e4b900b25345e09f9ed33123de6, 61d88ea0f30c88e4ea98793594943aed8f1fc9ab, 6.17.13unaffected
LinuxLinux6.6.120, 6.12.63, 6.18.2unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.