{"id":28490,"date":"2026-09-25T00:31:33","date_gmt":"2026-09-24T16:31:33","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93226"},"modified":"2026-09-25T00:31:33","modified_gmt":"2026-09-24T16:31:33","slug":"cve-2026-93226","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93226","title":{"rendered":"CVE-2026-93226 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU iterato"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ipv6: use RCU iterator to dump route exceptions<\/p>\n<p>rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over<br \/>\nRCU-protected exception lists. The caller holds rcu_read_lock(), but does<br \/>\nnot hold rt6_exception_lock, so rt6_insert_exception() can concurrently<br \/>\nadd an entry with hlist_add_head_rcu().<\/p>\n<p>KCSAN reports this race (irrelevant details omitted):<\/p>\n<p>  ==================================================================<br \/>\n  BUG: KCSAN: data-race in rt6_insert_exception \/ rt6_nh_dump_exceptions<\/p>\n<p>  write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:<br \/>\n    rt6_insert_exception+0x3bb\/0x760<br \/>\n    __ip6_rt_update_pmtu+0x4fe\/0x750<br \/>\n    ip6_sk_update_pmtu+0x19a\/0x3b0<br \/>\n    udpv6_err+0x3ff\/0x800<br \/>\n    icmpv6_notify+0x1e1\/0x440<br \/>\n    icmpv6_rcv+0x8c0\/0xab0<br \/>\n    ip6_protocol_deliver_rcu+0x616\/0x840<br \/>\n    ip6_input_finish+0xb9\/0x160<br \/>\n    &#8230;<br \/>\n    entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n<p>  read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:<br \/>\n    rt6_nh_dump_exceptions+0xb3\/0x260<br \/>\n    rt6_dump_route+0x53e\/0x5f0<br \/>\n    fib6_dump_node+0x6d\/0xf0<br \/>\n    fib6_walk_continue+0x290\/0x2d0<br \/>\n    fib6_dump_table+0x28d\/0x360<br \/>\n    inet6_dump_fib+0x37d\/0x620<br \/>\n    rtnl_dumpit+0x7b\/0xd0<br \/>\n    netlink_dump+0x3ae\/0x7e0<br \/>\n    &#8230;<br \/>\n    entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n<p>  4 locks held by dumper\/549:<br \/>\n    &#8230;<br \/>\n    #1: (rcu_read_lock){&#8230;.}-{1:3}, at: inet6_dump_fib+0x88\/0x620<br \/>\n    #2: (&amp;tb-&gt;tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9\/0x360<br \/>\n    #3: (rcu_read_lock){&#8230;.}-{1:3}, at: rt6_dump_route+0x483\/0x5f0<\/p>\n<p>  value changed: 0xffff8a7c44e05700 -&gt; 0xffff8a7c45d60100<\/p>\n<p>  Reported by Kernel Concurrency Sanitizer on:<br \/>\n  CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted<br \/>\n  7.2.0-rc7-virtme #38 PREEMPT(lazy)<br \/>\n  &#8230;<\/p>\n<p>Use hlist_for_each_entry_rcu() to safely iterate over the exception list.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ipv6: use RCU iterator to dump route exceptions<\/p>\n<p>rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over<br \/>\nRCU-protected<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28490","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28490","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}