CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Prevent rt6_insert_exception() for dying fib6_info.

Before the cited commit, fib6_nh_flush_exceptions() always set

from->exception_bucket_flushed = 1 under rt6_exception_lock to

prevent rt6_insert_exception() from inserting a new exception

for a dying fib6_info.

The flag was replaced with the FIB6_EXCEPTION_BUCKET_FLUSHED

bit stored in nh->rt6i_exception_bucket.

The problem is that now the bit is only set when the bucket

is not NULL and fib6_nh_flush_exceptions() is called from

fib6_nh_release() after fib6_ref has already reached zero.

If rt6_insert_exception() is called while the target fib6_info

is being removed via fib6_purge_rt(), a new exception could be

created successfully because rt6_flush_exceptions() no longer

sets the bit.

This creates a reference cycle between the fib6_info and the

exception route, leaking the fib6_info, its nexthop device,

and all per-CPU routes in fib6_nh->rt6i_pcpu, which stalls netdev

unregistration.

[ 34.680602] unregister_netdevice: waiting for gre6 to become free. Usage count = 68

[ 44.920675] unregister_netdevice: waiting for gre6 to become free. Usage count = 68

[ 55.176582] unregister_netdevice: waiting for gre6 to become free. Usage count = 68

Let's call fib6_drop_pcpu_from() before rt6_flush_exceptions(),

to set fib6_destroying before rt6_exception_lock, and check

f6i->fib6_destroying in rt6_insert_exception().

Note that FIB6_EXCEPTION_BUCKET_FLUSHED logic is dead and

we can clean it up in net-next.