CVE-2026-74657

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74657", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.923Z", "datePublished": "2026-08-22T15:32:31.458Z", "dateUpdated": "2026-11-06T17:05:50.029Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:39:57.259Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\n\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\n\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\n\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_semantics.c"], "versions": [{"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "0f0ca602941d0a81ae9514943ca06c55159c6385", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "5307a53599fa762c06e475ee4a375252074fd324", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "7f80ad373ce4a7af5367ff273cea0f16e91387f3", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "4a5dfbae5179f6574695012a980476254df2d295", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "a59edda6eda1252340354322d8ab318b2e9052fb", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "9b22f13524fa0de0d963bbd3002df6c28bae3395", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "4ff9548d84945d2cbf9e4c207288063a200ea397", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_semantics.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.267", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.10.267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28"}, {"url": "https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385"}, {"url": "https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324"}, {"url": "https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3"}, {"url": "https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295"}, {"url": "https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb"}, {"url": "https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395"}, {"url": "https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397"}], "title": "ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74657", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:29.811370Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:05:50.029Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74657", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:29.811370Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:00:30.847Z"}}], "cna": {"title": "ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28", "versionType": "git"}, {"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "0f0ca602941d0a81ae9514943ca06c55159c6385", "versionType": "git"}, {"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "5307a53599fa762c06e475ee4a375252074fd324", "versionType": "git"}, {"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "7f80ad373ce4a7af5367ff273cea0f16e91387f3", "versionType": "git"}, {"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "4a5dfbae5179f6574695012a980476254df2d295", "versionType": "git"}, {"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "a59edda6eda1252340354322d8ab318b2e9052fb", "versionType": "git"}, {"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "9b22f13524fa0de0d963bbd3002df6c28bae3395", "versionType": "git"}, {"status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "4ff9548d84945d2cbf9e4c207288063a200ea397", "versionType": "git"}], "programFiles": ["net/ipv4/fib_semantics.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"status": "unaffected", "version": "0", "lessThan": "5.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.267", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv4/fib_semantics.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28"}, {"url": "https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385"}, {"url": "https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324"}, {"url": "https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3"}, {"url": "https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295"}, {"url": "https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb"}, {"url": "https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395"}, {"url": "https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\n\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\n\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\n\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.267", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:39:57.259Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74657", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:05:50.029Z", "dateReserved": "2026-08-15T05:44:03.923Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:31.458Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/fib_semantics.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "0f0ca602941d0a81ae9514943ca06c55159c6385", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "5307a53599fa762c06e475ee4a375252074fd324", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "7f80ad373ce4a7af5367ff273cea0f16e91387f3", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "4a5dfbae5179f6574695012a980476254df2d295", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "a59edda6eda1252340354322d8ab318b2e9052fb", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "9b22f13524fa0de0d963bbd3002df6c28bae3395", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "4ff9548d84945d2cbf9e4c207288063a200ea397", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/fib_semantics.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.267", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\n\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\n\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\n\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv4: Arreglo de fib_nlmsg_size() para los saltos siguientes RTA_VIA\n\nfib_nlmsg_size() todav\u00eda estima el espacio del salto siguiente como si cada puerta de enlace estuviera codificada como un atributo IPv4 RTA_GATEWAY. Las rutas IPv4 tambi\u00e9n pueden llevar una puerta de enlace IPv6, que fib_nexthop_info() vuelca como RTA_VIA.\n\nComo resultado, las notificaciones de ruta pueden asignar un skb que es demasiado peque\u00f1o. fib_dump_info() entonces falla con -EMSGSIZE y rtmsg_fib() alcanza el WARN_ON() que marca tales fallos como un error de fib_nlmsg_size(). Con panic_on_warn configurado, esto se convierte en un p\u00e1nico del kernel.\n\nReflejar la disposici\u00f3n real del volcado del salto siguiente en fib_nlmsg_size(): tener en cuenta las puertas de enlace de salto siguiente IPv6 volcadas como RTA_VIA, para la disposici\u00f3n rtnexthop sin cabecera utilizada dentro de RTA_MULTIPATH, y para RTA_FLOW solo cuando est\u00e1 realmente presente."}], "id": "CVE-2026-74657", "lastModified": "2026-11-06T17:19:52.760", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74657", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:00:29.811370Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:39.333", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops", "id": "2521393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521393"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present.", "A flaw was found in the Linux kernel. The `fib_nlmsg_size()` function, which estimates the size for network message buffers, incorrectly calculates the required space for nexthops when IPv4 routes contain an IPv6 gateway. This error can lead to the allocation of an undersized buffer for route notifications. As a result, the system may experience a kernel panic, leading to a Denial of Service (DoS)."], "name": "CVE-2026-74657", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74657\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74657\nhttps://lore.kernel.org/linux-cve-announce/2026082227-CVE-2026-74657-70ac@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,0f0ca602941d0a81ae9514943ca06c55159c6385)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,5307a53599fa762c06e475ee4a375252074fd324)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,7f80ad373ce4a7af5367ff273cea0f16e91387f3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,4a5dfbae5179f6574695012a980476254df2d295)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,a59edda6eda1252340354322d8ab318b2e9052fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,9b22f13524fa0de0d963bb3002df6c28bae3395)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,4ff9548d84945d2cbf9e4c207288063a200ea397)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.733473+00:00", "updated": "2026-08-25T15:30:05.658331+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}