Live › vulnerability › CVE-2026-99073
Go to dashboardA race in the Linux kernel's IPv4 FIB dump code lets a route dump run while a nexthop group is being replaced with one that has fewer paths. The dump then dereferences a null pointer, which can crash the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with IPv4 routing and nexthop groups, where routing tables are dumped (for example by routing daemons or queries) while nexthop groups are replaced. The sources do not say which kernel versions are vulnerable. Hosts without nexthop group usage are less likely to hit the race.
ip routeNo product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed in the NVD entry.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop exception dump when nexthop group shrinks
Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement.
fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and the dump dereferences it through nhc_flags.
Stop the walk when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.
This page as .md · .json · in your agent: get_signal("CVE-2026-99073")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.