---
cve: "CVE-2026-89790"
severity: "LOW"
cvss: 3.1
epss: "20%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-16 09:17:09"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-19T12:14:42+02:00"
---

# CVE-2026-89790

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

ipv6: avoid divide by zero in rt6_multipath_rebalance

rt6_multipath_rebalance() calculates the total eligible nexthop weight
in one pass and programs upper bounds in a second pass. Since
RTM_NEWROUTE is RTNL-free, a concurrent
ignore_routes_with_linkdown update can make the first pass return zero
while the second sees an eligible nexthop, causing
rt6_upper_bound_set() to divide by zero.

UBSAN: division-overflow in net/ipv6/route.c:4845:17
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
  rt6_upper_bound_set() net/ipv6/route.c:4845
  rt6_multipath_rebalance()
  fib6_add_rt2node()
  ip6_route_multipath_add()
  inet6_rtm_newroute()

Skip upper-bound calculation when the first pass reports a zero total.
This respects the lock-free performance considerations here and solves
insecure scenarios.

## Patch verfügbar (OSV)

- Kernel ≥ 6.18.52
- Kernel ≥ 7.2.6

## Referenzen

- <https://git.kernel.org/stable/c/f30cf8fd9872299c0c27f9916252ba2b9f422dce>
- <https://git.kernel.org/stable/c/f82b5dbb2fef65b52a62d5ffe05e0483c4385a83>
- <https://git.kernel.org/stable/c/d2c26c2911dd1a363c488add4fb63eb5f0f28f87>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89790) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_