Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89790— ipv6: avoid divide by zero in rt6_multipath_rebalance

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6_multipath_rebalance rt6_multipath_rebalance() calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTM_N

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89790

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv6: avoid divide by zero in rt6_multipath_rebalance
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6_multipath_rebalance rt6_multipath_rebalance() calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTM_NEWROUTE is RTNL-free, a concurrent ignore_routes_with_linkdown update can make the first pass return zero while the second sees an eligible nexthop, causing rt6_upper_bound_set() to divide by zero. UBSAN: division-overflow in net/ipv6/route.c:4845:17 Oops: divide error: 0000 [#1] SMP KASAN NOPTI rt6_upper_bound_set() net/ipv6/route.c:4845 rt6_multipath_rebalance() fib6_add_rt2node() ip6_route_multipath_add() inet6_rtm_newroute() Skip upper-bound calculation when the first pass reports a zero total. This respects the lock-free performance considerations here and solves insecure scenarios.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux bd11ff421d36abdb585b9104fa70057bf01b3110 ~ f30cf8fd9872299c0c27f9916252ba2b9f422dce -
Linux Linux 6.16 -

II. Public POCs for CVE-2026-89790

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89790

请登录查看更多情报信息。

Other References for CVE-2026-89790 (3)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-89860 scsi: qla2xxx: Initialize NVMe abort_work once at submission
CVE-2026-89877 media: saa7164: fix cleanup on resource allocation failure
CVE-2026-89875 media: ti: vpe: quiesce overflow recovery before freeing streams
CVE-2026-89876 media: tda18250: fix possible integer overflow
CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error
CVE-2026-89872 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
CVE-2026-89873 media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
CVE-2026-89871 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
CVE-2026-89870 media: zoran: Avoid freeing a registered video_device twice
CVE-2026-89869 media: qcom: iris: use disable_irq() during power-off
CVE-2026-89868 media: chips-media: wave5: Add timeout while stop_streaming
CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued
CVE-2026-89866 media: chips-media: wave5: Resume device before setting EOS flag
CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
CVE-2026-89862 scsi: qla2xxx: Fix BSG job leak on validate flash image error path
CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
CVE-2026-89850 scsi: qla2xxx: Don't query firmware state while chip is down
CVE-2026-89848 scsi: qla2xxx: Quiesce response IRQ before freeing request queue

Showing top 20 of 276 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89790

No comments yet

Leave a comment