CVE-2026-99070
NoneCVSS
—
EPSS
0.2%
Published
Oct 23, 2026
CISA due date
—
Cloudanix analysis
A small internal timing issue in network route handling was fixed so the system stops printing an unnecessary error message.
- Exploitation
- Other
- Attacker needs
- Local User
- Complexity
- Theoretical
- Impact
- Other
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
A race between fib6_info_hw_flags_set sizing an skb with rt6_nlmsg_size and a later rt6_fill_node call can legitimately return -EMSGSIZE when nexthop groups change concurrently under compatibility mode, producing a spurious kernel warning.
Why it matters to the business
Negligible operational effect; low-prevalence IPv6 environments may see occasional misleading log noise with no service disruption or data exposure risk.
How an attack unfolds
No attacker-controlled exploitation is possible; the condition only triggers an internal warning path that already frees the skb and reports the error to listeners.
How to fix it
Apply the upstream kernel commit that removes the warning from fib6_info_hw_flags_set; no configuration changes are required.
How to confirm the fix worked
After patching, confirm the warning no longer appears in dmesg or kernel logs during concurrent IPv6 route updates with nexthop compatibility enabled.
How to detect it
Search kernel logs and audit trails for the removed warning string around route notification events; absence of the message post-patch confirms resolution.
What your security team should do
- Apply the fix during the next scheduled kernel update window
- Review IPv6 routing logs for any related warnings as a hygiene check
The record
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug. Remove the warning. The existing error path still frees the skb and reports the error to listeners.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|