Not yet scoredPublished Sep 25, 2026

CVE-2026-98031nexthop: Initialize extack in remove_nh_grp_entry()

Updated under an hour ago (Oct 29, 2026, 1:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in remove_nh_grp_entry() remove_nh_grp_entry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer. Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nh_res_bucket_migrate()").

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	833a1065eeb14437a9a0dfa9dad06ea09894e0b5 builds before 35d9ec61466109ef0c2de87067338d929f629527; from 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before 704319510af2179cf03955747d714ab291075c25; 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 builds before 17acbcd4c5a6ca3dd3f9e52eb203c9175bde609a; 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 builds before 030c878eaedf0449e2b5401a0a0146d0afcc645e; from 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before d643cea4248668dc493c513aa7cbc6505eb1a4a9; from 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 before d80677ad7aa5bebfccfd58caa4852b65abe70561; 833a1065eeb14437a9a0dfa9dad06ea09894e0b5 builds before 5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55b	CNA record

References

References

https://git.kernel.org/stable/c/35d9ec61466109ef0c2de87067338d929f629527
https://git.kernel.org/stable/c/704319510af2179cf03955747d714ab291075c25
https://git.kernel.org/stable/c/17acbcd4c5a6ca3dd3f9e52eb203c9175bde609a
https://git.kernel.org/stable/c/030c878eaedf0449e2b5401a0a0146d0afcc645e
https://git.kernel.org/stable/c/d643cea4248668dc493c513aa7cbc6505eb1a4a9
https://git.kernel.org/stable/c/d80677ad7aa5bebfccfd58caa4852b65abe70561
https://git.kernel.org/stable/c/5bd9e4e7cdaa03879e9b73b12ab52cceb1edd55b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.