CVE-2026-99070

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug. Remove the warning. The existing error path still frees the skb and reports the error to listeners.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-23 13:17:30.907000

Last modified

2026-10-30 13:21:43.290000

View original CVE JSON

{
  "id": "CVE-2026-99070",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-23T13:17:30.907",
  "lastModified": "2026-10-30T13:21:43.290",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node().  With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots.  rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning.  The existing error path still frees the skb and\nreports the error to listeners."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "907eea486888cfe118c19759bbc4b8fca2e004df",
              "lessThan": "dac2b0328495971c7b417fd0143e53643343936e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "907eea486888cfe118c19759bbc4b8fca2e004df",
              "lessThan": "24b2c95a046e15c9504a6d672b6b0b252952493f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "907eea486888cfe118c19759bbc4b8fca2e004df",
              "lessThan": "8a3b935b6b6037eefb36bd27a60793a008358e8d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "907eea486888cfe118c19759bbc4b8fca2e004df",
              "lessThan": "7b112bd43f1172fb152e848570a957467008a5ae",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "907eea486888cfe118c19759bbc4b8fca2e004df",
              "lessThan": "4ac7d92a4698e34e614c254359665b9de1f65283",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "907eea486888cfe118c19759bbc4b8fca2e004df",
              "lessThan": "291fe0bafee78c95f9f2e7f579f17793fd5a1e5a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "907eea486888cfe118c19759bbc4b8fca2e004df",
              "lessThan": "c97426ec649d99596d8969e1a052c16b14b7b485",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.224",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.113",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.57",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.11",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/24b2c95a046e15c9504a6d672b6b0b252952493f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/291fe0bafee78c95f9f2e7f579f17793fd5a1e5a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c97426ec649d99596d8969e1a052c16b14b7b485",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dac2b0328495971c7b417fd0143e53643343936e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}