All vulnerabilities
CVE-2026-98031

Linux: nexthop: Initialize extack in remove_nh_grp_entry()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in35d9ec61466109ef0c2de87067338d929f629527Also 704319510af2179cf03955747d714ab291075c25, 17acbcd4c5a6ca3dd3f9e52eb203c9175bde609a and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 35d9ec61466109ef0c2de87067338d929f629527LinuxCVE List
  • 704319510af2179cf03955747d714ab291075c25LinuxCVE List
  • 17acbcd4c5a6ca3dd3f9e52eb203c9175bde609aLinuxCVE List
  • 030c878eaedf0449e2b5401a0a0146d0afcc645eLinuxCVE List
  • 5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: Initialize extack in remove_nh_grp_entry()

remove_nh_grp_entry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer.

Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nh_res_bucket_migrate()").

Text from CVE List

Affected versions 16

  • Linuxaffected: 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before 35d9ec61466109ef0c2de87067338d929f629527CVE List
  • Linuxaffected: 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before 704319510af2179cf03955747d714ab291075c25CVE List
  • Linuxaffected: 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before 17acbcd4c5a6ca3dd3f9e52eb203c9175bde609aCVE List
  • Linuxaffected: 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before 030c878eaedf0449e2b5401a0a0146d0afcc645eCVE List
  • Linuxaffected: 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before d643cea4248668dc493c513aa7cbc6505eb1a4a9CVE List
  • Linuxaffected: 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before d80677ad7aa5bebfccfd58caa4852b65abe70561CVE List
  • Linuxaffected: 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before 5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55bCVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7