All vulnerabilities
CVE-2026-99071

Linux: ipv4: do not warn on route notification size race

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in088ba80eef85fa7a5ad8f9e7c82b403c99242b56Also 78a1cf5c54b2f795c81fedb530755a8d01cc84f0, 7dfa7ca97f3ac46353edd4cc44f7733758e4535b and 1 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 088ba80eef85fa7a5ad8f9e7c82b403c99242b56LinuxCVE List
  • 78a1cf5c54b2f795c81fedb530755a8d01cc84f0LinuxCVE List
  • 7dfa7ca97f3ac46353edd4cc44f7733758e4535bLinuxCVE List
  • 221ef5e1e44a044790f0f54e6aa237883f475a4dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: do not warn on route notification size race

Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added asynchronous route notifications for hardware flag changes.

fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later fills it with fib_dump_info() while holding only RCU. With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. fib_dump_info() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.

Remove the warning. The existing error path still frees the skb and reports the error to listeners.

Text from CVE List

Affected versions 12

  • Linuxaffected: 680aea08e78c003292415518ad270bc20f9c80b1 before 088ba80eef85fa7a5ad8f9e7c82b403c99242b56CVE List
  • Linuxaffected: 680aea08e78c003292415518ad270bc20f9c80b1 before 78a1cf5c54b2f795c81fedb530755a8d01cc84f0CVE List
  • Linuxaffected: 680aea08e78c003292415518ad270bc20f9c80b1 before 7dfa7ca97f3ac46353edd4cc44f7733758e4535bCVE List
  • Linuxaffected: 680aea08e78c003292415518ad270bc20f9c80b1 before 221ef5e1e44a044790f0f54e6aa237883f475a4dCVE List
  • Linuxaffected: 680aea08e78c003292415518ad270bc20f9c80b1 before e02a5b6588161673ef75a4bc5cdfb62bd493374dCVE List
  • Linuxaffected: 5.12CVE List
  • Linuxunaffected: all versions before 5.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5