---
id: CVE-2025-38588
title: 'ipv6: prevent infinite loop in rt6_nlmsg_size()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: prevent infinite loop in rt6_nlmsg_size()

  While testing prior patch, I was able to trigger
  an infinite loop in rt6_nlmsg_size() in the following place:

  list_for…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 <
    6d345136c9b875f065d226908a29c25cdf9343f8
  - >-
    Linux >= 52da02521ede55fb86546c3fffd9377b3261b91f <
    e1b7932af47f92432be8303d2439d1bf77b0be23
  - >-
    Linux >= 34a949e7a0869dfa31a40416d2a56973fae1807b <
    cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38
  - >-
    Linux >= d9ccb18f83ea2bb654289b6ecf014fd267cc988b <
    3c13db3e47e170bab19e574404e7b6be45ea873d
  - >-
    Linux >= d9ccb18f83ea2bb654289b6ecf014fd267cc988b <
    46aeb66e9e54ed0d56c18615e1c3dbd502b327ab
  - >-
    Linux >= d9ccb18f83ea2bb654289b6ecf014fd267cc988b <
    54e6fe9dd3b0e7c481c2228782c9494d653546da
  - Linux 11edcd026012ac18acee0f1514db3ed1b160fc6f
  - Linux >= 6.1.128 < 6.1.148
  - Linux >= 6.6.75 < 6.6.102
  - Linux >= 6.12.2 < 6.12.42
  - Linux >= 6.11.11 < 6.12
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:04:39.948956Z'
published: '2025-08-19'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:48.220Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38588'
references:
  - url: 'https://git.kernel.org/stable/c/6d345136c9b875f065d226908a29c25cdf9343f8'
  - url: 'https://git.kernel.org/stable/c/e1b7932af47f92432be8303d2439d1bf77b0be23'
  - url: 'https://git.kernel.org/stable/c/cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38'
  - url: 'https://git.kernel.org/stable/c/3c13db3e47e170bab19e574404e7b6be45ea873d'
  - url: 'https://git.kernel.org/stable/c/46aeb66e9e54ed0d56c18615e1c3dbd502b327ab'
  - url: 'https://git.kernel.org/stable/c/54e6fe9dd3b0e7c481c2228782c9494d653546da'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.06047
ingestedAt: '2026-11-05T22:38:31.997Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent infinite loop in rt6_nlmsg_size()

While testing prior patch, I was able to trigger
an infinite loop in rt6_nlmsg_size() in the following place:

list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
			fib6_siblings) {
	rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len);
}

This is because fib6_del_route() and fib6_add_rt2node()
uses list_del_rcu(), which can confuse rcu readers,
because they might no longer see the head of the list.

Restart the loop if f6i->fib6_nsiblings is zero.

## Affected

- `Linux >= d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 < 6d345136c9b875f065d226908a29c25cdf9343f8`
- `Linux >= 52da02521ede55fb86546c3fffd9377b3261b91f < e1b7932af47f92432be8303d2439d1bf77b0be23`
- `Linux >= 34a949e7a0869dfa31a40416d2a56973fae1807b < cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38`
- `Linux >= d9ccb18f83ea2bb654289b6ecf014fd267cc988b < 3c13db3e47e170bab19e574404e7b6be45ea873d`
- `Linux >= d9ccb18f83ea2bb654289b6ecf014fd267cc988b < 46aeb66e9e54ed0d56c18615e1c3dbd502b327ab`
- `Linux >= d9ccb18f83ea2bb654289b6ecf014fd267cc988b < 54e6fe9dd3b0e7c481c2228782c9494d653546da`
- `Linux 11edcd026012ac18acee0f1514db3ed1b160fc6f`
- `Linux >= 6.1.128 < 6.1.148`
- `Linux >= 6.6.75 < 6.6.102`
- `Linux >= 6.12.2 < 6.12.42`
- `Linux >= 6.11.11 < 6.12`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.