Cloudanix VulnDB

CVE-2026-98278

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking issue lets certain privileged users set up tunnel configurations that can trigger internal warnings and disrupt network traffic handling.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

A CAP_NET_ADMIN user can configure an IP or IPv6 tunnel whose remote endpoint resolves back to the tunnel itself, causing dev_fill_forward_path() to hit a WARN_ON_ONCE(last_dev == ctx->dev) during flowtable offload attempts for ipip or ip6_tnl tunnels.

Why it matters to the business

Network stability can be disrupted by kernel warnings or walk failures when processing tunneled traffic under self-referential routing setups, affecting availability of systems relying on Linux kernel networking.

How an attack unfolds

An attacker with CAP_NET_ADMIN privileges creates a tunnel routing loop, then triggers flowtable offload through the tunnel so that ipip_fill_forward_path or ip6_tnl_fill_forward_path sets ctx->dev to the tunnel device itself, hitting the warning instead of cleanly failing the walk.

How to fix it

Update the Linux kernel to a version containing the fix that removes the WARN_ON_ONCE and simply fails the forward path walk on loop detection, matching the approach used in prior similar changes.

How to confirm the fix worked

Confirm the patched kernel no longer emits the warning when a self-referential tunnel configuration is exercised with flowtable offload; inspect kernel source or dmesg for the removed check.

Typical attack path

  1. Obtain CAP_NET_ADMIN capabilities on a Linux system
  2. Configure an IP/IPv6 tunnel with a route to its own remote endpoint
  3. Initiate traffic that causes a flowtable to attempt offload through the tunnel
  4. Trigger the dev_fill_forward_path loop check to fire the warning

How to detect it

Review kernel logs (dmesg, syslog) for WARN_ON_ONCE entries referencing last_dev, ctx->dev, dev_fill_forward_path, ipip_fill_forward_path, or ip6_tnl_fill_forward_path around tunnel or flowtable activity.

What your security team should do

  • Restrict CAP_NET_ADMIN to trusted administrative accounts only
  • Apply the upstream kernel patch removing the WARN_ON_ONCE in dev_fill_forward_path
  • Monitor kernel logs for any remaining forward-path or tunnel-related warnings

The record

In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the route to the tunnel's remote endpoint and set ctx->dev to its device, which is the tunnel itself when that route resolves back to the tunnel. dev_fill_forward_path() then makes no progress and trips WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to offload a flow through the tunnel. That routing loop is a configuration any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and ip6_tnl_xmit() already treat it as a tx error, so remove the warning and just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE when accessing forward path array") did for the path stack overflow.

Affected packages

Ecosystem Package Introduced Fixed