Is there a patch available for EUVD-2026-86231?

Yes, a patch is available for EUVD-2026-86231. Update the affected software to the latest version immediately.

Linux EUVD-2026-86231

| CVE-2026-93226

2026-09-24 Linux

GHSA-wvgv-43w8-m5vv

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU iterator to dump route exceptions

rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over RCU-protected exception lists. The caller holds rcu_read_lock(), but does not hold rt6_exception_lock, so rt6_insert_exception() can concurrently add an entry with hlist_add_head_rcu().

KCSAN reports this race (irrelevant details omitted):

============== BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions

write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5: rt6_insert_exception+0x3bb/0x760 __ip6_rt_update_pmtu+0x4fe/0x750 ip6_sk_update_pmtu+0x19a/0x3b0 udpv6_err+0x3ff/0x800 icmpv6_notify+0x1e1/0x440 icmpv6_rcv+0x8c0/0xab0 ip6_protocol_deliver_rcu+0x616/0x840 ip6_input_finish+0xb9/0x160 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14: rt6_nh_dump_exceptions+0xb3/0x260 rt6_dump_route+0x53e/0x5f0 fib6_dump_node+0x6d/0xf0 fib6_walk_continue+0x290/0x2d0 fib6_dump_table+0x28d/0x360 inet6_dump_fib+0x37d/0x620 rtnl_dumpit+0x7b/0xd0 netlink_dump+0x3ae/0x7e0 ... entry_SYSCALL_64_after_hwframe+0x77/0x7f

4 locks held by dumper/549: ... #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620 #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360 #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0

value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100

Reported by Kernel Concurrency Sanitizer on: CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted 7.2.0-rc7-virtme #38 PREEMPT(lazy) ...

Use hlist_for_each_entry_rcu() to safely iterate over the exception list.

Affected VersionsENISA

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <6bd3f94ed858f2d072627546b4cdf712b0f8ea88

Linux 5.3

Linux patch: 6.1.188

Linux patch: 7.3-rc1

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <a602cd128d17a793e12888edc8eda85821ede7e1

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <47cdab0d51aaa9bd85f8e4904585bd5bd4df4488

Linux patch: 0

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <3665abc3d2ae8a78cb67f858e848481432ec75db

Linux patch: 5.15.221

Linux patch: 6.6.157

Linux patch: 6.12.109

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <dffbfb3117138e8e0e09d05f507bd36ca1f696e5

Linux patch: 5.10.270

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <f6b1b15848fd91fe122dac0d19d3d666e35075b6

Linux patch: 7.2.4

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <eda56ee17713f9dd834b922f7dbfa2e25fa6358c

Linux patch: 6.18.50

Linux 1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9 <9c6be625e1a7258e845d6193b3b6b084a00f8e9e

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Sep 24, 2026 - 17:18 EUVD

CVE Published

Sep 24, 2026 - 15:28 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.