{"id":"CVE-2026-99072","kind":"vulnerability","aliases":["CVE-2026-99072"],"related":[],"title":"Linux kernel IPv4: route notification crashes when nexthop group shrinks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh->nh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.","summary":"A race in the Linux kernel's IPv4 route notification code can dereference a NULL pointer when a nexthop group is replaced with fewer paths during the size calculation. The sources do not state what an attacker can gain beyond a kernel crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","networking","routers"],"not_affected_if":[],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in your distribution's advisory\n- unknown whether the sources list specific affected kernel versions","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving this ipv4 fix\n- unknown which exact kernel versions carry the fix, as the sources do not say","status":"open","published_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:44+00:00","updated_at":"2026-10-25T04:53:44+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:53:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving this ipv4 fix\n- unknown which exact kernel versions carry the fix, as the sources do not say","reach":"local","title":"Linux kernel IPv4: route notification crashes when nexthop group shrinks","impact":"medium","summary":"A race in the Linux kernel's IPv4 route notification code can dereference a NULL pointer when a nexthop group is replaced with fewer paths during the size calculation. The sources do not state what an attacker can gain beyond a kernel crash.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","networking","routers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel NULL dereference crashes the machine under a route update race","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges and whether an unprivileged attacker can trigger the race.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in your distribution's advisory\n- unknown whether the sources list specific affected kernel versions","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the affected IPv4 route notification code that use nexthop groups and hardware flag notifications, which is where the faulty path runs. Systems without nexthop group churn on IPv4 routes are less likely to hit the race. The sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000624,"input_tokens":3495,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99072':13A,16A '680aea08e78c':86C 'absent':162C 'add':97C 'asynchron':107C 'attack':59B 'beyond':62B 'calcul':51B 'call':105C 'chang':96C 'check':114C 'code':33B 'commit':85C 'crash':6A,65B 'current':169C 'cve':11A,14A 'dens':166C 'derefer':35B,153C 'emit':89C 'fewer':46B,138C 'fib':92C,102C,111C,115C,123C,143C,149C 'flag':94C,109C 'follow':71C 'gain':61B 'group':9A,42B,83C,136C,164C 'grp':130C 'hardwar':93C,108C 'independ':126C 'index':159C 'info':116C,124C,144C 'infrastructur':17B 'ipv4':3A,30B,76C,88C 'iter':121C 'kernel':2A,20B,28B,64B,69C 'later':173C 'linux':1A,19B,27B,68C 'linux-kernel':18B 'load':142C 'net':87C 'network':21B 'newnexthop':133C 'nexthop':8A,41B,82C,150C,163C 'nh':128C,129C 'nhc':125C,145C 'nlmsg':103C,112C,151C 'notif':5A,32B,79C,90C,110C 'null':37B,147C 'num':117C 'path':47B,118C,139C,160C,174C 'pointer':38B 'race':24B 'rcu':100C 'rcu-on':99C 'reload':127C 'replac':44B,134C 'resolv':75C 'return':146C 'rout':4A,31B,78C 'router':22B 'rtm':132C 'shrink':10A,84C 'size':50B,80C,104C,113C,152C,156C 'snapshot':170C 'sourc':53B 'state':56B 'stop':77C,155C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the affected IPv4 route notification code that use nexthop groups and hardware flag notifications, which is where the faulty path runs. Systems without nexthop group churn on IPv4 routes are less likely to hit the race. The sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99072","severity":null,"published_at":"2026-10-23T13:17:31+00:00","modified_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}