Live › vulnerability › CVE-2026-99070
Go to dashboardThe Linux kernel's IPv6 code printed a warning when a route notification skb was too small, which can happen legitimately when a nexthop group changes concurrently. The fix removes the warning; the existing error path already frees the buffer and reports the error.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Linux kernels with IPv6 routing and nexthop compatibility mode enabled, where routes are replaced concurrently. The sources describe a warning only, not a memory or access flaw, so it is unclear who would notice more than a kernel log message.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ipv6: do not warn on route notification size race
fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and reports the error to listeners.
This page as .md · .json · in your agent: get_signal("CVE-2026-99070")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.