Cloudanix VulnDB

CVE-2026-99071

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small race condition in how the Linux kernel reports IPv4 route changes could cause confusing error messages but does not let attackers break in or steal data.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race between fib_nlmsg_size() and fib_dump_info() under RCU when nexthop groups change concurrently can cause fib_dump_info() to return -EMSGSIZE, triggering an inappropriate warning even though the sizing logic is correct.

Why it matters to the business

Spurious kernel warnings and minor operational noise on systems using IPv4 route notifications with nexthop compatibility mode; no data loss or service disruption expected.

How an attack unfolds

An attacker with local access or the ability to trigger concurrent route changes can induce the race condition, causing the kernel to emit warnings and drop the notification skb, but the error path already handles the failure gracefully with no privilege escalation or information leak.

How to fix it

Apply the upstream fix that removes the warning; rebuild and deploy the updated kernel. No configuration changes are required.

How to confirm the fix worked

Confirm the warning no longer appears in dmesg under the described race; verify the commit removing the warning is present in the running kernel source.

Typical attack path

  1. Enable nexthop compatibility mode
  2. Trigger concurrent fib alias hardware flag updates and route replacements
  3. Observe -EMSGSIZE return from fib_dump_info() while holding only RCU
  4. Kernel emits warning and frees the undersized skb

How to detect it

Search kernel logs for the removed warning string and for unexpected -EMSGSIZE returns from fib_dump_info during route notification processing.

What your security team should do

  • Update to a kernel containing the fix within normal patch cycles
  • Monitor dmesg for related fib_nlmsg warnings as a temporary detection measure
  • No immediate action needed given low EPSS and absence from KEV

The record

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added asynchronous route notifications for hardware flag changes. fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later fills it with fib_dump_info() while holding only RCU. With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. fib_dump_info() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug. Remove the warning. The existing error path still frees the skb and reports the error to listeners.

Affected packages

Ecosystem Package Introduced Fixed