All vulnerabilities
CVE-2026-98278

Linux: net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in150dba2c69e93302af24a0c868eebe4871e2e107Fixed versionCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 150dba2c69e93302af24a0c868eebe4871e2e107LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check

ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the route to the tunnel's remote endpoint and set ctx->dev to its device, which is the tunnel itself when that route resolves back to the tunnel. dev_fill_forward_path() then makes no progress and trips WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to offload a flow through the tunnel. That routing loop is a configuration any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and ip6_tnl_xmit() already treat it as a tx error, so remove the warning and just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE when accessing forward path array") did for the path stack overflow.

Text from CVE List

Affected versions 6

  • Linuxaffected: ab427db17885814069bae891834f20842f0ac3a4 before d8eb177632dacda28bc6130c2105afbf5b791eb0CVE List
  • Linuxaffected: ab427db17885814069bae891834f20842f0ac3a4 before 150dba2c69e93302af24a0c868eebe4871e2e107CVE List
  • Linuxaffected: 6.19CVE List
  • Linuxunaffected: all versions before 6.19CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2