Medium 5.5Published Apr 23, 2026

CVE-2026-31531ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()

Updated under an hour ago (Oct 28, 2026, 9:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops. This results in the following warning splat: WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608 [...] RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395) [...] Call Trace: <TASK> rtnetlink_rcv_msg (net/core/rtnetlink.c:6989) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585) ___sys_sendmsg (net/socket.c:2641) __sys_sendmsg (net/socket.c:2671) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too. This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows: addattr_l ERROR: message exceeded bound of 1048

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	430a049190de3c9e219f43084de9f1122da04570 builds before 18a4543c1750f96be63e349936d2dfdcb360b2dc; from 430a049190de3c9e219f43084de9f1122da04570 before 615517f3f8d53b0cf41507c7599971e17adfdfa5; 430a049190de3c9e219f43084de9f1122da04570 builds before 40bd39e383a0478fd5c221f393df05fd9d70cfbc; from 430a049190de3c9e219f43084de9f1122da04570 before 635038fe19db391117e66b46bdc2b6e447ac801d; 430a049190de3c9e219f43084de9f1122da04570 builds before 14cf0cd35361f4e94824bf8a42f72713d7702a73	CNA record
linux linux_kernel linux:linux_kernel	from 5.3 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/18a4543c1750f96be63e349936d2dfdcb360b2dc
https://git.kernel.org/stable/c/615517f3f8d53b0cf41507c7599971e17adfdfa5	patch
https://git.kernel.org/stable/c/40bd39e383a0478fd5c221f393df05fd9d70cfbc	patch
https://git.kernel.org/stable/c/635038fe19db391117e66b46bdc2b6e447ac801d	patch
https://git.kernel.org/stable/c/14cf0cd35361f4e94824bf8a42f72713d7702a73	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.