All vulnerabilities
CVE-2026-99073

Linux: ipv4: stop exception dump when nexthop group shrinks

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in21cba134c30c17ae55f468b5809336437df5d7e6Also 4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 21cba134c30c17ae55f468b5809336437df5d7e6LinuxCVE List
  • 4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: stop exception dump when nexthop group shrinks

Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement.

fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and the dump dereferences it through nhc_flags.

Stop the walk when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.

Text from CVE List

Affected versions 10

  • Linuxaffected: 4ce5dc9316de50e0da84beafe55d1344f829cece before f91e472821e32f58b03eb631e20a67157e2b928bCVE List
  • Linuxaffected: 4ce5dc9316de50e0da84beafe55d1344f829cece before 21cba134c30c17ae55f468b5809336437df5d7e6CVE List
  • Linuxaffected: 4ce5dc9316de50e0da84beafe55d1344f829cece before b9a30bb7b831e8c5a47fadbdf1760918aaf009ccCVE List
  • Linuxaffected: 4ce5dc9316de50e0da84beafe55d1344f829cece before 4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2CVE List
  • Linuxaffected: 6.9CVE List
  • Linuxunaffected: all versions before 6.9CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4