{"schema":"threatline.record/2","record":{"id":"CVE-2026-98278","aliases":[],"summary":"net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check\n\nipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the\nroute to the tunnel's remote endpoint and set ctx->dev to its device,\nwhich is the tunnel itself when that route resolves back to the tunnel.\ndev_fill_forward_path() then makes no progress and trips\nWARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to\noffload a flow through the tunnel. That routing loop is a configuration\nany CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and\nip6_tnl_xmit() already treat it as a tx error, so remove the warning and\njust fail the walk, as commit 008e7a7c293b (\"net: remove WARN_ON_ONCE\nwhen accessing forward path array\") did for the path stack overflow.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98278","source_modified_at":"2026-10-19T09:16:49.865Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"d8eb177632dacda28bc6130c2105afbf5b791eb0","status":"affected","versionType":"git"},{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"150dba2c69e93302af24a0c868eebe4871e2e107","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98278","source_modified_at":"2026-10-19T09:16:49.865Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98278","source_modified_at":"2026-10-19T09:16:49.865Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"150dba2c69e93302af24a0c868eebe4871e2e107","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00179,"percentile":0.07101,"score_date":"2026-10-23"},"published_at":"2026-10-06T08:45:38.346Z","modified_at":"2026-10-19T09:16:49.865Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98278","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:16:49.865Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98278","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/d8eb177632dacda28bc6130c2105afbf5b791eb0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/150dba2c69e93302af24a0c868eebe4871e2e107"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:16:49.865Z","content_hash":"383574936ce3265136d52bcaffdf76c59313cc7a4a7319f4295ba3e4b007b387"}}