CVE-2026-99121 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv4: avoid divide by zero in fib_rebalance
fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_routes_with_linkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero.
If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6_multipath_rebalance") and preserves the lock-free rebalance path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Linux kernel vulnerability identified within the ipv4 networking subsystem involves a critical arithmetic error located in the fib_rebalance function, which is responsible for managing multipath routing decisions based on nexthop weights. This routine operates by performing two distinct passes over the available routes to ensure efficient and balanced traffic distribution across multiple paths. In the initial pass, the system calculates the aggregate weight of all eligible next hops that are currently active and reachable. Subsequently, in a second pass, the kernel programs upper bounds for these nexthops based on the total weight computed earlier. This two-phase approach is designed to maintain performance by avoiding complex locking mechanisms during routine rebalancing operations, thereby preserving lock-free execution paths which are crucial for high-throughput network environments.
The core technical flaw arises from a race condition involving concurrent modifications to routing tables, specifically when the ignore_routes_with_linkdown parameter changes state while fib_rebalance is executing. If this configuration change occurs between or during the two passes, it can lead to an inconsistent state where the first pass calculates a total eligible weight of zero because certain routes are temporarily ignored due to link status changes. However, by the time the second pass executes, the system may perceive at least one nexthop as eligible and attempt to distribute traffic based on this partial view. When the code attempts to divide by the previously calculated total weight of zero during the assignment of upper bounds for each nexthop, a division-by-zero exception is triggered. This arithmetic error typically results in a kernel panic or system crash, effectively causing a denial of service condition that disrupts network connectivity and stability on affected systems.
From a classification perspective, this vulnerability aligns with CWE-369, which denotes divide by zero errors, often exacerbated by CWE-362 indicating insufficient synchronization mechanisms for concurrent access to shared resources. The operational impact is severe as it allows an attacker or even benign system events related to interface state changes to crash the host kernel. This falls under MITRE ATT&CK technique T1595, specifically Active Scanning, where adversaries might probe network interfaces to trigger such race conditions, although in this context, simple link flapping could suffice without malicious intent. The stability of the networking stack is compromised because fib_rebalance is a frequently executed path during route updates and interface state transitions, making it a high-value target for exploitation or accidental triggering through normal operational fluctuations.
The resolution implemented addresses this issue by introducing a safeguard check within the rebalancing logic. If the first pass determines that the total eligible weight is zero, the kernel now sets each nexthop upper bound to -1 and explicitly skips the division operation. This approach mirrors the fix previously applied to the IPv6 subsystem in commit d2c26c2911dd for rt6_multipath_rebalance, ensuring consistency across both IP versions. By handling the zero-weight case gracefully without performing invalid arithmetic, the patch preserves the lock-free nature of the rebalance path while eliminating the crash vector. This mitigation ensures that even under rapid link state changes or concurrent routing updates, the kernel maintains stability and continues to process traffic according to available paths rather than failing catastrophically due to an edge-case arithmetic error.