CVE-2026-99071

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99071", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.389Z", "datePublished": "2026-10-23T12:23:14.297Z", "dateUpdated": "2026-10-30T12:41:30.940Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:30.940Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_trie.c"], "versions": [{"version": "680aea08e78c003292415518ad270bc20f9c80b1", "lessThan": "8b35e7767fdee63e57948a1ec89d9238a651f8c6", "status": "affected", "versionType": "git"}, {"version": "680aea08e78c003292415518ad270bc20f9c80b1", "lessThan": "096ad0cb77f8da1928d04a0d170535e14ca6311b", "status": "affected", "versionType": "git"}, {"version": "680aea08e78c003292415518ad270bc20f9c80b1", "lessThan": "088ba80eef85fa7a5ad8f9e7c82b403c99242b56", "status": "affected", "versionType": "git"}, {"version": "680aea08e78c003292415518ad270bc20f9c80b1", "lessThan": "78a1cf5c54b2f795c81fedb530755a8d01cc84f0", "status": "affected", "versionType": "git"}, {"version": "680aea08e78c003292415518ad270bc20f9c80b1", "lessThan": "7dfa7ca97f3ac46353edd4cc44f7733758e4535b", "status": "affected", "versionType": "git"}, {"version": "680aea08e78c003292415518ad270bc20f9c80b1", "lessThan": "221ef5e1e44a044790f0f54e6aa237883f475a4d", "status": "affected", "versionType": "git"}, {"version": "680aea08e78c003292415518ad270bc20f9c80b1", "lessThan": "e02a5b6588161673ef75a4bc5cdfb62bd493374d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_trie.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8b35e7767fdee63e57948a1ec89d9238a651f8c6"}, {"url": "https://git.kernel.org/stable/c/096ad0cb77f8da1928d04a0d170535e14ca6311b"}, {"url": "https://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56"}, {"url": "https://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0"}, {"url": "https://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b"}, {"url": "https://git.kernel.org/stable/c/221ef5e1e44a044790f0f54e6aa237883f475a4d"}, {"url": "https://git.kernel.org/stable/c/e02a5b6588161673ef75a4bc5cdfb62bd493374d"}], "title": "ipv4: do not warn on route notification size race", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/fib_trie.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8b35e7767fdee63e57948a1ec89d9238a651f8c6", "status": "affected", "version": "680aea08e78c003292415518ad270bc20f9c80b1", "versionType": "git"}, {"lessThan": "096ad0cb77f8da1928d04a0d170535e14ca6311b", "status": "affected", "version": "680aea08e78c003292415518ad270bc20f9c80b1", "versionType": "git"}, {"lessThan": "088ba80eef85fa7a5ad8f9e7c82b403c99242b56", "status": "affected", "version": "680aea08e78c003292415518ad270bc20f9c80b1", "versionType": "git"}, {"lessThan": "78a1cf5c54b2f795c81fedb530755a8d01cc84f0", "status": "affected", "version": "680aea08e78c003292415518ad270bc20f9c80b1", "versionType": "git"}, {"lessThan": "7dfa7ca97f3ac46353edd4cc44f7733758e4535b", "status": "affected", "version": "680aea08e78c003292415518ad270bc20f9c80b1", "versionType": "git"}, {"lessThan": "221ef5e1e44a044790f0f54e6aa237883f475a4d", "status": "affected", "version": "680aea08e78c003292415518ad270bc20f9c80b1", "versionType": "git"}, {"lessThan": "e02a5b6588161673ef75a4bc5cdfb62bd493374d", "status": "affected", "version": "680aea08e78c003292415518ad270bc20f9c80b1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/fib_trie.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners."}], "id": "CVE-2026-99071", "lastModified": "2026-10-30T13:21:43.410", "metrics": {}, "published": "2026-10-23T13:17:31.027", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/096ad0cb77f8da1928d04a0d170535e14ca6311b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/221ef5e1e44a044790f0f54e6aa237883f475a4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b35e7767fdee63e57948a1ec89d9238a651f8c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e02a5b6588161673ef75a4bc5cdfb62bd493374d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via route notification sizing race in IPv4", "id": "2559707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559707"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv4: do not warn on route notification size race\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.", "A flaw was found in the Linux kernel's IPv4 networking subsystem. A local user with network administration privileges can trigger a race condition during concurrent routing table updates. This timing issue occurs when preparing route change notifications, generating an unexpected message size error that triggers an internal kernel warning. This flaw may result in a Denial of Service (DoS) if the system is configured to crash on kernel warnings."], "name": "CVE-2026-99071", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-23T12:23:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99071\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99071\nhttps://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56\nhttps://git.kernel.org/stable/c/221ef5e1e44a044790f0f54e6aa237883f475a4d\nhttps://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0\nhttps://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b\nhttps://git.kernel.org/stable/c/e02a5b6588161673ef75a4bc5cdfb62bd493374d"], "statement": "This vulnerability is rated as having a Moderate impact because exploitation requires local access with elevated network administration privileges and precise timing during concurrent routing modifications. On default Red Hat Enterprise Linux installations, standard unprivileged users cannot manipulate routing tables, significantly restricting the potential attack surface. Furthermore, the issue manifests as an unexpected kernel warning rather than memory corruption, causing system termination only in non-standard environments specifically configured to panic on warnings.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,088ba80eef85fa7a5ad8f9e7c82b403c99242b56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,78a1cf5c54b2f795c81fedb530755a8d01cc84f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,7dfa7ca97f3ac46353edd4cc44f7733758e4535b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,221ef5e1e44a044790f0f54e6aa237883f475a4d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,e02a5b6588161673ef75a4bc5cdfb62bd493374d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,088ba80eef85fa7a5ad8f9e7c82b403c99242b56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,78a1cf5c54b2f795c81fedb530755a8d01cc84f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,7dfa7ca97f3ac46353edd4cc44f7733758e4535b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,221ef5e1e44a044790f0f54e6aa237883f475a4d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[680aea08e78c003292415518ad270bc20f9c80b1,e02a5b6588161673ef75a4bc5cdfb62bd493374d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T16:45:17.942528+00:00", "updated": "2026-11-03T02:00:08.629079+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-617"]}