Linux Kernel CVE-2026-63968

The vulnerable code is in the IPv6 FIB (Forwarding Information Base) multipath routing logic (net/ipv6/route.c). fib6_select_path() walks the fib6_siblings list - an RCU-protected circular linked list of equal-cost multipath (ECMP) route siblings - during packet forwarding/route lookup in softirq context. The kernel uses RCU for lock-free read-side traversal while writers hold tb6_lock. When a writer calls list_del_rcu(&first->fib6_siblings) to detach a route, the removed node's .next pointer still references the old ring, so a concurrent reader that captured the pre-deletion state can loop forever because it never encounters the &first->fib6_siblings terminator. The fix mirrors commit f8d8ce1b515a (the analogous fib6_info_uses_dev() fix) and the rt6_fill_node() pattern: fib6_purge_rt() always WRITE_ONCE()s first->fib6_nsiblings to 0 before the list_del_rcu(), so the walker adds an inside-loop check on fib6_nsiblings as a reliable detach signal to break out. This is a classic RCU list-deletion/reader-writer race (root cause class akin to CWE-835 Loop with Unreachable Exit Condition / CWE-362 concurrency race), though NVD lists CWE as N/A. Per CPE the affected component is the linux:linux kernel across the stable series.