CVE-2026-99070
ipv6: do not warn on route notification size race
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.2%
Percentile 10.5%
as of 2026-10-24
CISA KEV
—
Not listed
Description
NVD
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug. Remove the warning. The existing error path still frees the skb and reports the error to listeners.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: 907eea486888cfe118c19759bbc4b8fca2e004df … < 8a3b935b6b6037eefb36bd27a60793a008358e8d affected: 907eea486888cfe118c19759bbc4b8fca2e004df … < 7b112bd43f1172fb152e848570a957467008a5ae affected: 907eea486888cfe118c19759bbc4b8fca2e004df … < 4ac7d92a4698e34e614c254359665b9de1f65283 affected: 907eea486888cfe118c19759bbc4b8fca2e004df … < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5a affected: 907eea486888cfe118c19759bbc4b8fca2e004df … < c97426ec649d99596d8969e1a052c16b14b7b485 default: unaffected |
| Linux | Linux | affected: 5.12 unaffected: 0 … < 5.12 unaffected: 6.6.160 … <= 6.6.* unaffected: 6.12.113 … <= 6.12.* unaffected: 6.18.57 … <= 6.18.* unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
CVE-2026-99070
OSV
ipv6: do not warn on route notification size race
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= 907eea486888cfe118c19759bbc4b8fca2e004df, < 8a3b935b6b6037eefb36bd27a60793a008358e8d; < 7b112bd43f1172fb152e848570a957467008a5ae; < 4ac7d92a4698e34e614c254359665b9de1f65283; < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5a; < c97426ec649d99596d8969e1a052c16b14b7b485 | 8a3b935b6b6037eefb36bd27a60793a008358e8d, 7b112bd43f1172fb152e848570a957467008a5ae, 4ac7d92a4698e34e614c254359665b9de1f65283, 291fe0bafee78c95f9f2e7f579f17793fd5a1e5a, c97426ec649d99596d8969e1a052c16b14b7b485 | ||
| Linux | Kernel | >= 5.12.0, < 6.6.160; >= 6.7.0, < 6.12.113; >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.11 | 6.6.160, 6.12.113, 6.18.57, 7.2.11 |
Linux distribution status
References (8)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/291fe0bafee78c95f9f2e7f579f17793fd5a1e5a NVD, CNA, OSV
- https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283 NVD, CNA, OSV
- https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae NVD, CNA, OSV
- https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d NVD, CNA, OSV
- https://git.kernel.org/stable/c/c97426ec649d99596d8969e1a052c16b14b7b485 NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99070.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-99070 OSV