CVE-2026-98031

nexthop: Initialize extack in remove_nh_grp_entry()

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: Initialize extack in remove_nh_grp_entry()

remove_nh_grp_entry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer.

Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nh_res_bucket_migrate()").

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 35d9ec61466109ef0c2de87067338d929f629527Affected 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 704319510af2179cf03955747d714ab291075c25Affected 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 17acbcd4c5a6ca3dd3f9e52eb203c9175bde609aAffected 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 030c878eaedf0449e2b5401a0a0146d0afcc645eAffected 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before d643cea4248668dc493c513aa7cbc6505eb1a4a9Affected 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before d80677ad7aa5bebfccfd58caa4852b65abe70561Affected 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55bAffected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 35d9ec61466109ef0c2de87067338d929f629527Affected
833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 704319510af2179cf03955747d714ab291075c25Affected
833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 17acbcd4c5a6ca3dd3f9e52eb203c9175bde609aAffected
833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 030c878eaedf0449e2b5401a0a0146d0afcc645eAffected
833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before d643cea4248668dc493c513aa7cbc6505eb1a4a9Affected
833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before d80677ad7aa5bebfccfd58caa4852b65abe70561Affected
833a1065eeb14437a9a0dfa9dad06ea09894e0b5 to before 5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55bAffected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.