CVE-2026-23200: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23200 is a denial-of-service vulnerability in the Linux kernel's IPv6 routing subsystem, specifically in the fib6_add_rt2node() function. It was published on February 14, 2026, and affects Linux kernel versions 6.6.120–6.6.123, 6.12.63–6.12.69, 6.17.13–6.17.x (before 6.18), 6.18.2–6.18.9, and release candidates 6.19-rc1 through 6.19-rc8. The vulnerability was introduced by commit f72514b3c569 ("ipv6: clear RA flags when adding a static route") and allows a local unprivileged user to trigger a kernel BUG/panic. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper state management (CWE-476) in the IPv6 routing code: when RTF_ADDRCONF is cleared from an existing route that has a gateway, that route becomes eligible for ECMP (Equal-Cost Multi-Path routing) via rt6_qualify_for_ecmp(), but it was never added to the fib6_siblings list. This creates a mismatch between the sibling count computed by iterating the fib6_next chain and the actual count in fib6_siblings. When a subsequent ECMP route is added, fib6_add_rt2node() hits BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings), crashing the kernel. The fix restricts RTF_ADDRCONF clearing to routes without a gateway, since such routes cannot qualify for ECMP anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family) (Feedly, Kernel Patch).

Successful exploitation causes a kernel panic (BUG condition), resulting in a complete denial of service for the affected system. A local user with low privileges can crash the host by manipulating IPv6 route configurations via ioctl operations. There is no impact on confidentiality or integrity — only system availability is affected, and no lateral movement or data exfiltration is enabled by this vulnerability (Feedly).

Update the Linux kernel to one of the patched versions: 6.6.124 or later (6.6.x series), 6.12.70 or later (6.12.x series), 6.18.10 or later (6.18.x series), or any stable 6.19 release. Patch commits are available at git.kernel.org (hashes: 50b7c7a255858a85c4636a1e990ca04591153dca, b8ad2d53f706aeea833d23d45c0758398fede580, bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25, d8143c54ceeba232dc8a13aa0afa14a44b371d93). As a temporary workaround where patching is not immediately possible, restrict local user access to IPv6 route configuration operations using standard Linux access controls (e.g., limiting CAP_NET_ADMIN capabilities and restricting which users can execute ioctl-based route management commands) (Feedly, Kernel Patch).

Downstream Linux distributions including Debian, Ubuntu, and Oracle Linux have issued security advisories and updated kernel packages addressing this vulnerability. Tenable has published Nessus detection plugins (IDs: 299086, 303468, 318847) for identifying affected systems. No notable independent researcher commentary or significant social media discussion has been observed beyond routine vulnerability tracking (Debian Advisory, Ubuntu Advisory, Tenable).