CVE-2026-23200

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF

syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6

route. [0]

Commit f72514b3c569 ("ipv6: clear RA flags when adding a static

route") introduced logic to clear RTF_ADDRCONF from existing routes

when a static route with the same nexthop is added. However, this

causes a problem when the existing route has a gateway.

When RTF_ADDRCONF is cleared from a route that has a gateway, that

route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns

true. The issue is that this route was never added to the

fib6_siblings list.

This leads to a mismatch between the following counts:

- The sibling count computed by iterating fib6_next chain, which

includes the newly ECMP-eligible route

- The actual siblings in fib6_siblings list, which does not include

that route

When a subsequent ECMP route is added, fib6_add_rt2node() hits

BUG_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References