{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: avoid divide by zero in rt6_multipath_rebalance  rt6_multipath_rebalance() calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTM_NEWROUTE is RTNL-free, a concurrent ignore_routes_with_linkdown update can make the first pass return zero while the second sees an eligible nexthop, causing rt6_upper_bound_set() to divide by zero.  UBSAN: division-overflow in net/ipv6/route.c:4845:17 Oops: divide error: 0000 [#1] SMP KASAN NOPTI   rt6_upper_bound_set() net/ipv6/route.c:4845   rt6_multipath_rebalance()   fib6_add_rt2node()   ip6_route_multipath_add()   inet6_rtm_newroute()  Skip upper-bound calculation when the first pass reports a zero total. This respects the lock-free performance considerations here and solves insecure scenarios.",
  "id": "DEBIAN-CVE-2026-89790",
  "modified": "2026-09-17T04:47:29.935941576Z",
  "published": "2026-09-16T09:17:09.827Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89790"
    }
  ],
  "upstream": [
    "CVE-2026-89790"
  ]
}