- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check() detect an uncached route by list_empty(&rt->dst.rt_uncached), which replaced the static DST_NOCACHE flag check in commit a4c2fd7f7891 ("net: remove DST_NOCACHE flag"). When a device is unregistered, rt6_uncached_list_flush_dev() unlinks uncached routes tied to the device from rt6_uncached_list. Previously, they were moved to another list with list_move() (__list_del_entry() + list_add()), and since commit 98aa546af5e4 ("inet: remove (struct uncached_list)->quarantine"), the routes are just unlinked with list_del_init(). If list_del_init() runs concurrently, list_empty() evaluates to true; ip6_route_output_flags() calls dst_hold_safe() incorrectly and ip6_rt_put_flags() skips ip6_rt_put(), leaking dst, and thus dev tied via rt->from as well. The same race is partially fixed by commit 9a6f0c4d5796 ("dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()"). Let's check rt6->dst.rt_uncached_list instead. Note that IPv4 does not have the same issue.
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 98aa546af5e4f180439c82da403cc77926d3953b – < 5045aa25f3790dcdb158a58ac60ccf8da42959aa
- affected 98aa546af5e4f180439c82da403cc77926d3953b – < ed902d5546fb9c142b3216d8eec914fa1bc0aa80
- affected 98aa546af5e4f180439c82da403cc77926d3953b – < f9722746df13a8a29103c847ef56b02c11ce0963
- affected 98aa546af5e4f180439c82da403cc77926d3953b – < be31fe6333f534155e6b408f1ef6d77974bb41aa
- affected 6.11
- unaffected < 6.11
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.55 – ≤ 6.18.*
- unaffected 7.2.9 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References4
- https://git.kernel.org/stable/c/5045aa25f3790dcdb158a58ac60ccf8da42959aa (opens in a new tab)
- https://git.kernel.org/stable/c/ed902d5546fb9c142b3216d8eec914fa1bc0aa80 (opens in a new tab)
- https://git.kernel.org/stable/c/f9722746df13a8a29103c847ef56b02c11ce0963 (opens in a new tab)
- https://git.kernel.org/stable/c/be31fe6333f534155e6b408f1ef6d77974bb41aa (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-103641 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98596)Record last updated .