CVE-2026-99073ipv4: stop exception dump when nexthop group shrinks
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and the dump dereferences it through nhc_flags. Stop the walk when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 23, 2026
- First seen by InfoSec Signals
- Oct 23, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4ce5dc9316de50e0da84beafe55d1344f829cece before f91e472821e32f58b03eb631e20a67157e2b928b; from 4ce5dc9316de50e0da84beafe55d1344f829cece before 21cba134c30c17ae55f468b5809336437df5d7e6; from 4ce5dc9316de50e0da84beafe55d1344f829cece before b9a30bb7b831e8c5a47fadbdf1760918aaf009cc; from 4ce5dc9316de50e0da84beafe55d1344f829cece before 4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2 | CNA record |
References
- https://git.kernel.org/stable/c/f91e472821e32f58b03eb631e20a67157e2b928b
- https://git.kernel.org/stable/c/21cba134c30c17ae55f468b5809336437df5d7e6
- https://git.kernel.org/stable/c/b9a30bb7b831e8c5a47fadbdf1760918aaf009cc
- https://git.kernel.org/stable/c/4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.