CVE-2026-99072

What it actually does

Race condition in Linux kernel IPv4 fib_nlmsg_size and fib_info_nhc handling allows NULL pointer dereference when a nexthop group shrinks between path count check and nhc reload during asynchronous hardware flag notifications.

Why it matters to the business

Potential kernel crashes or instability on systems performing dynamic IPv4 routing changes, leading to network service disruption and requiring restarts in affected environments; low observed exploitation risk reduces immediate urgency.

How an attack unfolds

An attacker with local access or the ability to trigger route changes induces a timing window where RTM_NEWNEXTHOP replaces a nexthop group with fewer paths; the sizing function observes the original count then dereferences a now-absent path entry, causing a crash.

How to fix it

Apply the upstream kernel patch that stops sizing when the indexed path is absent; update to a Linux kernel version containing the fix for this race condition once released.

How to confirm the fix worked

Confirm kernel source contains the updated fib_nlmsg_size logic that checks path presence before dereference; test by exercising nexthop group shrink operations under load and verify absence of NULL dereference crashes.

Typical attack path

1. Obtain local execution or route manipulation capability on target system
2. Trigger repeated IPv4 route or nexthop group modifications to create shrinking events
3. Exploit the window between fib_info_num_path check and fib_info_nhc reload to dereference NULL
4. Cause kernel oops or panic to achieve denial of service

How to detect it

Inspect kernel logs for NULL pointer dereference oops in fib_nlmsg_size or ipv4 route notification paths around times of route table changes; correlate with netlink message activity.

What your security team should do

• Monitor for kernel updates addressing this IPv4 notification race and schedule rollout within standard patching cycles given low EPSS
• Review systems with heavy dynamic IPv4 routing for exposure and prioritize testing in lab environments
• Enable kernel crash reporting and logging to detect potential triggers post-deployment