CVE-2026-89790

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: avoid divide by zero in rt6_multipath_rebalance

rt6_multipath_rebalance() calculates the total eligible nexthop weight

in one pass and programs upper bounds in a second pass. Since

RTM_NEWROUTE is RTNL-free, a concurrent

ignore_routes_with_linkdown update can make the first pass return zero

while the second sees an eligible nexthop, causing

rt6_upper_bound_set() to divide by zero.

UBSAN: division-overflow in net/ipv6/route.c:4845:17

Oops: divide error: 0000 [#1] SMP KASAN NOPTI

rt6_upper_bound_set() net/ipv6/route.c:4845

rt6_multipath_rebalance()

fib6_add_rt2node()

ip6_route_multipath_add()

inet6_rtm_newroute()

Skip upper-bound calculation when the first pass reports a zero total.

This respects the lock-free performance considerations here and solves

insecure scenarios.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References