In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent infinite loop in rt6nlmsgsize()
While testing prior patch, I was able to trigger an infinite loop in rt6nlmsgsize() in the following place:
listforeachentryrcu(sibling, &f6i->fib6siblings, fib6siblings) { rt6nhnlmsgsize(sibling->fib6nh, &nexthop_len); }
This is because fib6delroute() and fib6addrt2node() uses listdelrcu(), which can confuse rcu readers, because they might no longer see the head of the list.
Restart the loop if f6i->fib6_nsiblings is zero.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1b7932af47f92432be8303d2439d1bf77b0be23",
"deprecated": false,
"digest": {
"function_hash": "301453613663134196562697790563404169788",
"length": 4751.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-2a49a9ae",
"signature_type": "Function",
"target": {
"function": "fib6_add_rt2node",
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c13db3e47e170bab19e574404e7b6be45ea873d",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"206033579981418908219696381304598007362",
"315288348987143694481624749803601816642",
"338872744769507551498737314149236536785",
"174001101455780303392123824682560520063",
"334390382256460211643052574630765497967",
"214144214580468619976042160064720441542",
"338872744769507551498737314149236536785",
"151986467203357522955743110668044459641"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-3bed96cf",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c13db3e47e170bab19e574404e7b6be45ea873d",
"deprecated": false,
"digest": {
"function_hash": "334479965457802527825136612077383034342",
"length": 757.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-3f508528",
"signature_type": "Function",
"target": {
"function": "rt6_nlmsg_size",
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46aeb66e9e54ed0d56c18615e1c3dbd502b327ab",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"206033579981418908219696381304598007362",
"315288348987143694481624749803601816642",
"8455753629433173249736202297882520813",
"152478422455078212504512961740578189592",
"334390382256460211643052574630765497967",
"214144214580468619976042160064720441542",
"338872744769507551498737314149236536785",
"151986467203357522955743110668044459641"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-7b875929",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c13db3e47e170bab19e574404e7b6be45ea873d",
"deprecated": false,
"digest": {
"function_hash": "64006018357907457951813961279122894139",
"length": 1905.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-821b04a8",
"signature_type": "Function",
"target": {
"function": "fib6_del_route",
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54e6fe9dd3b0e7c481c2228782c9494d653546da",
"deprecated": false,
"digest": {
"function_hash": "334479965457802527825136612077383034342",
"length": 757.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-8bfe5605",
"signature_type": "Function",
"target": {
"function": "rt6_nlmsg_size",
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46aeb66e9e54ed0d56c18615e1c3dbd502b327ab",
"deprecated": false,
"digest": {
"function_hash": "64006018357907457951813961279122894139",
"length": 1905.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-9385ddcd",
"signature_type": "Function",
"target": {
"function": "fib6_del_route",
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54e6fe9dd3b0e7c481c2228782c9494d653546da",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"206033579981418908219696381304598007362",
"315288348987143694481624749803601816642",
"8455753629433173249736202297882520813",
"152478422455078212504512961740578189592",
"334390382256460211643052574630765497967",
"214144214580468619976042160064720441542",
"338872744769507551498737314149236536785",
"151986467203357522955743110668044459641"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-a767fe3e",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54e6fe9dd3b0e7c481c2228782c9494d653546da",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"160592874806539787238946821217670612552",
"306617035986840763565020610931565651489",
"185662114174319944408369498761254976359",
"142875468429410523237961252909475109015",
"299481095427676301280205454253509379746",
"338841219294866731963162421833671274566",
"323198068160725747236345606270011285390",
"332272459481461178686655670180816291599",
"240399618359432149667011759442378188459",
"155030262897259017226050939438456911096",
"42341290453165557720850339695146062437",
"308046304231688907495091180962303220886",
"141592806495523811323383315655670614065",
"217913160389632890284110460735752018849",
"176252555494541367972148894843259861212",
"281213854328073624185270332917800704034",
"171640089340445221977295898314267347656",
"21737680714228206444708486972013459645",
"126273720928991104999832347469035950637",
"259351111613977813481061675878656571348",
"182198614028837151470013082460072824914",
"100911561375012352971660244933330688702",
"9803749019510184939894957399179026269",
"270543218585062662995044715765677778070"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-b3ffbea6",
"signature_type": "Line",
"target": {
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54e6fe9dd3b0e7c481c2228782c9494d653546da",
"deprecated": false,
"digest": {
"function_hash": "174671158405215436818386407869831757487",
"length": 4831.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-c65c51f9",
"signature_type": "Function",
"target": {
"function": "fib6_add_rt2node",
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1b7932af47f92432be8303d2439d1bf77b0be23",
"deprecated": false,
"digest": {
"function_hash": "334479965457802527825136612077383034342",
"length": 757.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-c9a821be",
"signature_type": "Function",
"target": {
"function": "rt6_nlmsg_size",
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46aeb66e9e54ed0d56c18615e1c3dbd502b327ab",
"deprecated": false,
"digest": {
"function_hash": "334479965457802527825136612077383034342",
"length": 757.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-ce7221fa",
"signature_type": "Function",
"target": {
"function": "rt6_nlmsg_size",
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1b7932af47f92432be8303d2439d1bf77b0be23",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"160592874806539787238946821217670612552",
"306617035986840763565020610931565651489",
"185662114174319944408369498761254976359",
"142875468429410523237961252909475109015",
"299481095427676301280205454253509379746",
"338841219294866731963162421833671274566",
"323198068160725747236345606270011285390",
"332272459481461178686655670180816291599",
"240399618359432149667011759442378188459",
"155030262897259017226050939438456911096",
"42341290453165557720850339695146062437",
"308046304231688907495091180962303220886",
"141592806495523811323383315655670614065",
"217913160389632890284110460735752018849",
"176252555494541367972148894843259861212",
"281213854328073624185270332917800704034",
"171640089340445221977295898314267347656",
"21737680714228206444708486972013459645",
"126273720928991104999832347469035950637",
"259351111613977813481061675878656571348",
"182198614028837151470013082460072824914",
"100911561375012352971660244933330688702",
"9803749019510184939894957399179026269",
"270543218585062662995044715765677778070"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-d92bbea1",
"signature_type": "Line",
"target": {
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1b7932af47f92432be8303d2439d1bf77b0be23",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"206033579981418908219696381304598007362",
"315288348987143694481624749803601816642",
"338872744769507551498737314149236536785",
"174001101455780303392123824682560520063",
"334390382256460211643052574630765497967",
"214144214580468619976042160064720441542",
"338872744769507551498737314149236536785",
"151986467203357522955743110668044459641"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-e663d2e6",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1b7932af47f92432be8303d2439d1bf77b0be23",
"deprecated": false,
"digest": {
"function_hash": "7479308488065149718051546294637305246",
"length": 1939.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-ea83b040",
"signature_type": "Function",
"target": {
"function": "fib6_del_route",
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54e6fe9dd3b0e7c481c2228782c9494d653546da",
"deprecated": false,
"digest": {
"function_hash": "64006018357907457951813961279122894139",
"length": 1905.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-ec74cd5f",
"signature_type": "Function",
"target": {
"function": "fib6_del_route",
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46aeb66e9e54ed0d56c18615e1c3dbd502b327ab",
"deprecated": false,
"digest": {
"function_hash": "174671158405215436818386407869831757487",
"length": 4831.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-ecd4084b",
"signature_type": "Function",
"target": {
"function": "fib6_add_rt2node",
"file": "net/ipv6/ip6_fib.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c13db3e47e170bab19e574404e7b6be45ea873d",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"160592874806539787238946821217670612552",
"306617035986840763565020610931565651489",
"185662114174319944408369498761254976359",
"142875468429410523237961252909475109015",
"299481095427676301280205454253509379746",
"338841219294866731963162421833671274566",
"323198068160725747236345606270011285390",
"332272459481461178686655670180816291599",
"240399618359432149667011759442378188459",
"155030262897259017226050939438456911096",
"42341290453165557720850339695146062437",
"308046304231688907495091180962303220886",
"141592806495523811323383315655670614065",
"217913160389632890284110460735752018849",
"176252555494541367972148894843259861212",
"281213854328073624185270332917800704034",
"171640089340445221977295898314267347656",
"21737680714228206444708486972013459645",
"126273720928991104999832347469035950637",
"259351111613977813481061675878656571348",
"182198614028837151470013082460072824914",
"100911561375012352971660244933330688702",
"9803749019510184939894957399179026269",
"270543218585062662995044715765677778070"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-f1748634",
"signature_type": "Line",
"target": {
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46aeb66e9e54ed0d56c18615e1c3dbd502b327ab",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"160592874806539787238946821217670612552",
"306617035986840763565020610931565651489",
"185662114174319944408369498761254976359",
"142875468429410523237961252909475109015",
"299481095427676301280205454253509379746",
"338841219294866731963162421833671274566",
"323198068160725747236345606270011285390",
"332272459481461178686655670180816291599",
"240399618359432149667011759442378188459",
"155030262897259017226050939438456911096",
"42341290453165557720850339695146062437",
"308046304231688907495091180962303220886",
"141592806495523811323383315655670614065",
"217913160389632890284110460735752018849",
"176252555494541367972148894843259861212",
"281213854328073624185270332917800704034",
"171640089340445221977295898314267347656",
"21737680714228206444708486972013459645",
"126273720928991104999832347469035950637",
"259351111613977813481061675878656571348",
"182198614028837151470013082460072824914",
"100911561375012352971660244933330688702",
"9803749019510184939894957399179026269",
"270543218585062662995044715765677778070"
]
},
"signature_version": "v1",
"id": "CVE-2025-38588-f4dd045c",
"signature_type": "Line",
"target": {
"file": "net/ipv6/route.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c13db3e47e170bab19e574404e7b6be45ea873d",
"deprecated": false,
"digest": {
"function_hash": "236785307904559292919464693177663169609",
"length": 4797.0
},
"signature_version": "v1",
"id": "CVE-2025-38588-fe4f6840",
"signature_type": "Function",
"target": {
"function": "fib6_add_rt2node",
"file": "net/ipv6/ip6_fib.c"
}
}
]