Linux Kernel CVE-2026-97940

Requires local access to a Linux host with IPv6 enabled, plus the ability to trigger FIB6 route deletion (adding/removing IPv6 routes, normally requiring CAP_NET_ADMIN, though obtainable in an unprivileged user namespace on some configs). The attacker must concurrently iterate the route table via /proc/net/ipv6_route or the BPF ipv6_route iterator while deleting the last route at a table root, and win the timing race that leaves the seq walker freed but still linked on net->ipv6.fib6_walkers. Limiting factors: local vector only (no remote reach), race-condition timing that is non-deterministic and may need many attempts, and the specific structural precondition that the deleted leaf be the last route at the FIB6 root; the BPF iterator path merely widens (does not remove) the race window.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H, base 7.8) presents this as a straightforward high-severity local privilege-affecting bug, but the description points to a narrower reality: this is a use-after-free race between iterating the IPv6 routing table dump (/proc/net/ipv6_route or the BPF ipv6_route iterator) and concurrent FIB6 route deletion. AC:L is arguable - winning a walker-unlink race that depends on the deleted leaf being the last route at the table root is not deterministic, so AC:H is more honest (assessed ~5.0). No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is: no public exploit identified at time of analysis. The C:H/I:H claim is questionable - the primary primitive is a dangling walker dereferenced during a later route deletion, which is a corruption/crash (DoS) rather than a confirmed confidentiality or integrity breach; the 'Information Disclosure' tag conflicts with the actual UAF/DoS nature. Net assessment: a legitimate kernel memory-safety bug worth patching in the normal cycle, but not an emergency - no evidence of exploitation, exploitation requires local access plus route-deletion capability (typically CAP_NET_ADMIN) and a timing race, and impact is crash-dominant.

A local user with the ability to add/delete IPv6 routes (typically CAP_NET_ADMIN in a namespace) repeatedly reads /proc/net/ipv6_route (or drives the BPF ipv6_route iterator) while concurrently deleting the last route at a FIB6 table root, so the seq walker is freed while still linked on net->ipv6.fib6_walkers. A subsequent route deletion walks the dangling list and dereferences the freed walker, corrupting kernel memory and typically panicking the host. No public exploit code is available, and the race is non-deterministic, so reliable triggering requires repeated attempts.