Live › vulnerability › CVE-2026-99072
Go to dashboardA race in the Linux kernel's IPv4 route notification code can dereference a NULL pointer when a nexthop group is replaced with fewer paths during the size calculation. The sources do not state what an attacker can gain beyond a kernel crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the affected IPv4 route notification code that use nexthop groups and hardware flag notifications, which is where the faulty path runs. Systems without nexthop group churn on IPv4 routes are less likely to hit the race. The sources do not say more.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel versions in your distribution's advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop route notification sizing when nexthop group shrinks
Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications.
fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it.
Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.
This page as .md · .json · in your agent: get_signal("CVE-2026-99072")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.