CVE-2025-38588

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: prevent infinite loop in rt6_nlmsg_size()<br /> <br /> While testing prior patch, I was able to trigger<br /> an infinite loop in rt6_nlmsg_size() in the following place:<br /> <br /> list_for_each_entry_rcu(sibling, &amp;f6i-&gt;fib6_siblings,<br /> fib6_siblings) {<br /> rt6_nh_nlmsg_size(sibling-&gt;fib6_nh, &amp;nexthop_len);<br /> }<br /> <br /> This is because fib6_del_route() and fib6_add_rt2node()<br /> uses list_del_rcu(), which can confuse rcu readers,<br /> because they might no longer see the head of the list.<br /> <br /> Restart the loop if f6i-&gt;fib6_nsiblings is zero.