-

CVE-2026-74657

ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops

In the Linux kernel, the following vulnerability has been resolved:

ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops

fib_nlmsg_size() still estimates nexthop space as if every gateway is
encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an
IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.

As a result, route notifications can allocate an skb that is too small.
fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the
WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With
panic_on_warn set, this becomes a kernel panic.

Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for
IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop
layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is
actually present.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version d15662682db232da77136cd348f4c9df312ca6f9
Version < 0f0ca602941d0a81ae9514943ca06c55159c6385
Status affected
Version d15662682db232da77136cd348f4c9df312ca6f9
Version < 5307a53599fa762c06e475ee4a375252074fd324
Status affected
Version d15662682db232da77136cd348f4c9df312ca6f9
Version < 7f80ad373ce4a7af5367ff273cea0f16e91387f3
Status affected
Version d15662682db232da77136cd348f4c9df312ca6f9
Version < 4a5dfbae5179f6574695012a980476254df2d295
Status affected
Version d15662682db232da77136cd348f4c9df312ca6f9
Version < a59edda6eda1252340354322d8ab318b2e9052fb
Status affected
Version d15662682db232da77136cd348f4c9df312ca6f9
Version < 9b22f13524fa0de0d963bbd3002df6c28bae3395
Status affected
Version d15662682db232da77136cd348f4c9df312ca6f9
Version < 4ff9548d84945d2cbf9e4c207288063a200ea397
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.2
Status affected
Version 0
Version < 5.2
Status unaffected
Version <= 5.15.*
Version 5.15.216
Status unaffected
Version <= 6.1.*
Version 6.1.183
Status unaffected
Version <= 6.6.*
Version 6.6.152
Status unaffected
Version <= 6.12.*
Version 6.12.104
Status unaffected
Version <= 6.18.*
Version 6.18.45
Status unaffected
Version <= 7.1.*
Version 7.1.9
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.067
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385
https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295
https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397
https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324
https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3
https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395
https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb