CVE-2026-23004

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()

in an interesting way [1]

Crash happens in list_del_init()/INIT_LIST_HEAD() while writing

list->prev, while the prior write on list->next went well.

static inline void INIT_LIST_HEAD(struct list_head *list)

{

WRITE_ONCE(list->next, list); // This went well

WRITE_ONCE(list->prev, list); // Crash, @list has been freed.

}

Issue here is that rt6_uncached_list_del() did not attempt to lock

ul->lock, as list_empty(&rt->dst.rt_uncached) returned

true because the WRITE_ONCE(list->next, list) happened on the other CPU.

We might use list_del_init_careful() and list_empty_careful(),

or make sure rt6_uncached_list_del() always grabs the spinlock

whenever rt->dst.rt_uncached_list has been set.

A similar fix is neeed for IPv4.

[1]

BUG: KASAN: slab-use-after-free in INIT_LIST_HEAD inclu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References