CVE-2026-99073

What it actually does

Race condition in fib_dump_info_fnhe allows concurrent nexthop group replacement to shrink the group between fib_info_num_path and fib_info_nhc loads, resulting in NULL return and subsequent dereference of nhc_flags during IPv4 FIB dump under RCU protection.

Why it matters to the business

Systems performing frequent route table dumps or exposed to local routing changes may experience kernel crashes leading to denial of service and loss of network connectivity until reboot.

How an attack unfolds

An attacker with local access triggers repeated RTM_NEWNEXTHOP operations that replace a nexthop group with fewer paths while an inet_dump_fib walk is in progress, hitting the window where the indexed path disappears and the dump dereferences NULL.

How to fix it

Update to a kernel containing the fix that stops the walk when the indexed path is absent. Reboot after installing the updated kernel package.

How to confirm the fix worked

Confirm the kernel version contains commit that adds the absence check in fib_dump_info_fnhe; attempt to reproduce the race with concurrent group replacement and dump operations under load.

Typical attack path

1. Obtain local execution on a Linux system running an affected kernel
2. Create or manipulate nexthop groups via netlink
3. Concurrently trigger FIB dumps (e.g., via monitoring tools or repeated route queries)
4. Induce group shrink between the two load points to trigger NULL dereference

How to detect it

Search kernel logs for NULL pointer dereference or oops involving fib_dump_info_fnhe or fib_info_nhc; look for netlink messages indicating rapid nexthop group changes during route dumps.

What your security team should do

• Prioritize kernel upgrade on all Linux hosts that perform dynamic routing or expose netlink interfaces
• Monitor for kernel oops or panic logs related to fib_dump_info_fnhe
• Restrict unprivileged netlink access where possible until patched