ipv6: prevent infinite loop in rt6_nlmsg_size() (CVE-2025-38588)

Summary

ipv6: prevent infinite loop in rt6_nlmsg_size()

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent infinite loop in rt6_nlmsg_size()

While testing prior patch, I was able to trigger
an infinite loop in rt6_nlmsg_size() in the following place:

list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
fib6_siblings) {
rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len);
}

This is because fib6_del_route() and fib6_add_rt2node()
uses list_del_rcu(), which can confuse rcu readers,
because they might no longer see the head of the list.

Restart the loop if f6i->fib6_nsiblings is zero.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.102"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.15.10"},{"fixed":"6.16.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2025-38588 linux-lts Fixed in: 6.1.151-r0
Debian DEBIAN-CVE-2025-38588 linux Fixed in: 6.1.148-1
Ubuntu UBUNTU-CVE-2025-38588 linux-hwe-edge

Summary

Original description

Affected packages

Fix status by distribution

References