All vulnerabilities
CVE-2026-98303

Linux: ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in06083cea4a3b95f5ebc85312f97d7086e6c9e782Also 83aa83f81a8fec30ff5372dee60b2f0561bcb2ca, 1af2d87964d87ba7626d96928d68c09158b5a223 and 1 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 06083cea4a3b95f5ebc85312f97d7086e6c9e782LinuxCVE List
  • 83aa83f81a8fec30ff5372dee60b2f0561bcb2caLinuxCVE List
  • 1af2d87964d87ba7626d96928d68c09158b5a223LinuxCVE List
  • 2998147b59c9df0a51477c7a6b3d1f0ba3127dd4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

When the forward output route cannot be used in icmp_route_lookup(), it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr, the original packet's source address.

ip_route_input() only returns an error for truly invalid packets. For unreachable addresses it will succeed and return an input route whose dst.output is set to ip_rt_bug(). The existing check only rejects RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned and later used for output, syzkaller triggering a WARN_ON_ONCE() in ip_rt_bug() as bellow:

------------[ cut here ]------------ WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20 RIP: 0010:ip_rt_bug+0x14/0x20 Call Trace: ip_push_pending_frames+0xfa/0x100 __icmp_send+0x905/0xf10 ip_options_compile+0xc0/0xd0 ip_rcv_finish_core+0x321/0xae0 ip_rcv+0x1de/0x260 __netif_receive_skb_one_core+0x11a/0x130 netif_receive_skb+0x7b/0x260 tun_get_user+0x11bf/0x1c10 ------------[ cut here ]------------

Reject input route that is RTN_UNREACHABLE to fix it. The net warning is only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of a race condition.

Text from CVE List

Affected versions 14

  • Linuxaffected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 before 06083cea4a3b95f5ebc85312f97d7086e6c9e782CVE List
  • Linuxaffected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 before 83aa83f81a8fec30ff5372dee60b2f0561bcb2caCVE List
  • Linuxaffected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 before cac69c50716c712ef0114837c9427da66066124cCVE List
  • Linuxaffected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 before 1af2d87964d87ba7626d96928d68c09158b5a223CVE List
  • Linuxaffected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 before fda3000147dc96c75ba162f680bec0a9fecf3037CVE List
  • Linuxaffected: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 before 2998147b59c9df0a51477c7a6b3d1f0ba3127dd4CVE List
  • Linuxaffected: 2.6.25CVE List
  • Linuxunaffected: all versions before 2.6.25CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6