Riskcovery

CVE-2026-99072

ipv4: stop route notification sizing when nexthop group shrinks

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 30, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: stop route notification sizing when nexthop group shrinks

Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications.

fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it.

Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 680aea08e78c003292415518ad270bc20f9c80b1 to before 96f3fbb8575593657c7e80786dc3251d2fe3931bAffected
  • 680aea08e78c003292415518ad270bc20f9c80b1 to before 81f0deb02a5b5477f236bbbaed1149b779a8632bAffected
  • 680aea08e78c003292415518ad270bc20f9c80b1 to before 72d9d17092bb37b0717f12042a0817d01a1f9e78Affected
  • 680aea08e78c003292415518ad270bc20f9c80b1 to before ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54Affected
  • 680aea08e78c003292415518ad270bc20f9c80b1 to before c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49Affected
  • 680aea08e78c003292415518ad270bc20f9c80b1 to before ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88Affected
  • 680aea08e78c003292415518ad270bc20f9c80b1 to before d3daa33c7af92e38f2274bbd2576f58bfbaf89e6Affected
LinuxLinux
  • 5.12Affected
  • before 5.12Not affected
  • 5.15.224 through 5.15.*Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.11 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.