In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible infinite loop in fib6selectpath()
Found while auditing the same pattern Sashiko reported in rt6fillnode() [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6infouses_dev()").
Writers holding tb6lock can listdelrcu(&first->fib6siblings) without waiting for RCU readers; first->fib6siblings.next then still points into the old ring and this softirq-side walker never reaches &first->fib6siblings as its terminator. fib6purgert() always WRITEONCE()s first->fib6nsiblings to 0 before listdelrcu(), so an inside-loop check is a reliable detach signal.
[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63968.json",
"cna_assigner": "Linux"
}