CVE-2026-99070

ipv6: do not warn on route notification size race

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: do not warn on route notification size race

fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.

Remove the warning. The existing error path still frees the skb and reports the error to listeners.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	907eea486888cfe118c19759bbc4b8fca2e004df to before dac2b0328495971c7b417fd0143e53643343936eAffected 907eea486888cfe118c19759bbc4b8fca2e004df to before 24b2c95a046e15c9504a6d672b6b0b252952493fAffected 907eea486888cfe118c19759bbc4b8fca2e004df to before 8a3b935b6b6037eefb36bd27a60793a008358e8dAffected 907eea486888cfe118c19759bbc4b8fca2e004df to before 7b112bd43f1172fb152e848570a957467008a5aeAffected 907eea486888cfe118c19759bbc4b8fca2e004df to before 4ac7d92a4698e34e614c254359665b9de1f65283Affected 907eea486888cfe118c19759bbc4b8fca2e004df to before 291fe0bafee78c95f9f2e7f579f17793fd5a1e5aAffected 907eea486888cfe118c19759bbc4b8fca2e004df to before c97426ec649d99596d8969e1a052c16b14b7b485Affected
LinuxLinux	5.12Affected before 5.12Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

907eea486888cfe118c19759bbc4b8fca2e004df to before dac2b0328495971c7b417fd0143e53643343936eAffected
907eea486888cfe118c19759bbc4b8fca2e004df to before 24b2c95a046e15c9504a6d672b6b0b252952493fAffected
907eea486888cfe118c19759bbc4b8fca2e004df to before 8a3b935b6b6037eefb36bd27a60793a008358e8dAffected
907eea486888cfe118c19759bbc4b8fca2e004df to before 7b112bd43f1172fb152e848570a957467008a5aeAffected
907eea486888cfe118c19759bbc4b8fca2e004df to before 4ac7d92a4698e34e614c254359665b9de1f65283Affected
907eea486888cfe118c19759bbc4b8fca2e004df to before 291fe0bafee78c95f9f2e7f579f17793fd5a1e5aAffected
907eea486888cfe118c19759bbc4b8fca2e004df to before c97426ec649d99596d8969e1a052c16b14b7b485Affected

LinuxLinux

5.12Affected
before 5.12Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.11 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.