Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-23004

In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_init()/INIT_LIST_HEAD() while writing list->prev, while the prior write on list->next went well. static inline void INIT_LIST_HEAD(struct list_head *list) { WRITE_ONCE(list->next, list); // This went well WRITE_ONCE(list->prev, list); /
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:2eefa209403772508767e2f6a1b67cf71d7137326036787ddbcb729100d727ae
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/dst.c","net/ipv4/route.c","net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"815db2363e51f0ef416947492d4dac5b7a520f56","status":"affected","version":"78df76a065ae3b5dbcb9a29912adc02f697de498","versionType":"git"},{"lessThan":"f24a52948c95e02facbca2b3b6eb5a225e27eb01","status":"affected","version":"78df76a065ae3b5dbcb9a29912adc02f697de498","versionType":"git"},{"lessThan":"722de945216144af7cd4d39bdeb936108d2595a7","status":"affected","ver…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/dst.c","net/ipv4/route.c","net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.6"},{"lessThan":"3.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.7","versio…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/dst.c","net/ipv4/route.c","net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"815db2363e51f0ef416947492d4dac5b7a520f56","status":"affected","version":"78df76a065ae3b5dbcb9a29912adc02f697de498","versionType":"git"},{"lessThan":"f24a52948c95e02facbca2b3b6eb5a225e27eb01","status":"affected","version":"78df76a065ae3b5dbcb9a29912adc02f697de498","versionType":"git"},{"lessThan":"722de945216144af7cd4d39bdeb936108d2595a7","status":"affected","ver…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/dst.c","net/ipv4/route.c","net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.6"},{"lessThan":"3.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.7","versio…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/metrics/0/cvssV3_1

Source references

4 source assertions
{"url":"https://git.kernel.org/stable/c/722de945216144af7cd4d39bdeb936108d2595a7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/815db2363e51f0ef416947492d4dac5b7a520f56"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/9a6f0c4d5796ab89b5a28a890ce542344d58bd69"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/f24a52948c95e02facbca2b3b6eb5a225e27eb01"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4381875fb72ebf32859d208128049f7366c36af6879de4558002033e9b2ec514 · sha256:a2d52bbec4e68444… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer