{"id":"CVE-2026-99070","kind":"vulnerability","aliases":["CVE-2026-99070"],"related":[],"title":"Linux kernel: IPv6 route notification warning fires on benign size race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node().  With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots.  rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning.  The existing error path still frees the skb and\nreports the error to listeners.","summary":"The Linux kernel's IPv6 code printed a warning when a route notification skb was too small, which can happen legitimately when a nexthop group changes concurrently. The fix removes the warning; the existing error path already frees the buffer and reports the error.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipv6","linux-kernel","routing"],"not_affected_if":["default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:30+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:48+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:53:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: IPv6 route notification warning fires on benign size race","impact":"low","summary":"The Linux kernel's IPv6 code printed a warning when a route notification skb was too small, which can happen legitimately when a nexthop group changes concurrently. The fix removes the warning; the existing error path already frees the buffer and reports the error.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ipv6","routing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel log gets a spurious warning message","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Systems running Linux kernels with IPv6 routing and nexthop compatibility mode enabled, where routes are replaced concurrently. The sources describe a warning only, not a memory or access flaw, so it is unclear who would notice more than a kernel log message.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000534,"input_tokens":3411,"output_tokens":385,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99070':14A,17A 'alreadi':60B 'benign':9A 'buffer':63B 'bug':139C 'chang':49B 'code':29B 'compat':109C 'concurr':50B,113C 'cve':12A,15A 'emsgsiz':130C 'enabl':111C 'error':58B,67B,145C,154C 'exist':57B,144C 'fib6':87C 'fill':101C,105C,124C 'fire':7A 'fix':52B 'flag':90C 'follow':73C 'free':61B,148C 'group':48B,118C 'grow':116C 'happen':43B 'hw':89C 'independ':121C 'info':88C 'infrastructur':18B 'ipv6':3A,19B,28B,78C 'kernel':2A,22B,26B,71C 'later':100C 'legitim':44B,128C 'linux':1A,21B,25B,70C 'linux-kernel':20B 'listen':156C 'mode':110C 'nexthop':47B,108C 'nlmsg':97C 'node':106C,125C 'notif':5A,36B,84C 'path':59B,146C 'print':30B 'prove':136C 'race':11A,86C 'remov':53B,140C 'replac':114C 'report':65B,152C 'resolv':77C 'return':129C 'rout':4A,23B,35B,83C 'rt6':96C,104C,123C 'set':91C 'size':10A,85C,92C,98C,138C 'skb':37B,94C,150C 'small':40B 'snapshot':122C 'still':147C 'vulner':74C 'warn':6A,32B,55B,81C,133C,142C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with IPv6 routing and nexthop compatibility mode enabled, where routes are replaced concurrently. The sources describe a warning only, not a memory or access flaw, so it is unclear who would notice more than a kernel log message.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99070","severity":null,"published_at":"2026-10-23T13:17:30+00:00","modified_at":"2026-10-23T13:17:30+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99070","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99070","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}