{"id":"CVE-2026-99073","kind":"vulnerability","aliases":["CVE-2026-99073"],"related":[],"title":"Linux kernel: IPv4 route dump can crash when nexthop group shrinks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop exception dump when nexthop group shrinks\n\nCommit 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU\nprotection\") allowed IPv4 FIB dumps to run concurrently with nexthop\nreplacement.\n\nfib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,\nthen fib_info_nhc() independently reloads nh->nh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and the dump dereferences it through\nnhc_flags.\n\nStop the walk when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.","summary":"A race in the Linux kernel's IPv4 FIB dump code lets a route dump run while a nexthop group is being replaced with one that has fewer paths. The dump then dereferences a null pointer, which can crash the kernel.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipv4","linux-kernel","routers","runtime"],"not_affected_if":["no-nexthop-groups"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry.\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-99073 (the fixed version is not stated in the sources).\n- unknown","status":"open","published_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:44+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:53:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving CVE-2026-99073 (the fixed version is not stated in the sources).\n- unknown","reach":"local","title":"Linux kernel: IPv4 route dump can crash when nexthop group shrinks","impact":"medium","summary":"A race in the Linux kernel's IPv4 FIB dump code lets a route dump run while a nexthop group is being replaced with one that has fewer paths. The dump then dereferences a null pointer, which can crash the kernel.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","routers","ipv4"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel crash through null pointer dereference during route dump","analyst_note":"Check the NVD entry and the kernel stable commit for affected and fixed version ranges, and whether a local user can trigger the race.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry.\n- unknown","needs_analyst":true,"not_affected_if":["no-nexthop-groups"],"who_is_affected":"Systems running a Linux kernel with IPv4 routing and nexthop groups, where routing tables are dumped (for example by routing daemons or `ip route` queries) while nexthop groups are replaced. The sources do not say which kernel versions are vulnerable. Hosts without nexthop group usage are less likely to hit the race.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000623,"input_tokens":3487,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99073':14A,17A '4ce5dc9316de':84C 'absent':158C 'allow':93C 'bound':115C 'code':34B 'commit':83C 'concurr':99C 'crash':7A,62B 'current':165C 'cve':12A,15A 'dens':162C 'derefer':56B,145C 'dump':5A,33B,38B,54B,78C,88C,96C,104C,144C 'except':77C 'fewer':51B,132C 'fib':32B,89C,95C,103C,108C,117C,137C 'flag':149C 'fnhe':106C 'follow':70C 'group':10A,43B,81C,130C,160C 'grp':124C 'independ':120C 'index':155C 'inet':85C,87C 'info':105C,109C,118C,138C 'ipv4':3A,18B,31B,75C,94C 'kernel':2A,21B,29B,64B,68C 'later':169C 'let':35B 'linux':1A,20B,28B,67C 'linux-kernel':19B 'load':136C 'loop':114C 'newnexthop':127C 'nexthop':9A,42B,80C,101C,159C 'nh':122C,123C 'nhc':119C,139C,148C 'null':58B,141C 'num':110C 'one':48B 'path':52B,111C,133C,156C,170C 'pointer':59B 'protect':92C 'race':25B 'rcu':91C 'reload':121C 'replac':46B,102C,128C 'resolv':74C 'return':140C 'rout':4A,37B 'router':22B 'rtm':126C 'run':39B,98C 'runtim':23B 'shrink':11A,82C 'snapshot':166C 'stop':76C,150C 'switch':86C 'use':107C 'vulner':71C 'walk':152C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IPv4 routing and nexthop groups, where routing tables are dumped (for example by routing daemons or `ip route` queries) while nexthop groups are replaced. The sources do not say which kernel versions are vulnerable. Hosts without nexthop group usage are less likely to hit the race.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99073","severity":null,"published_at":"2026-10-23T13:17:31+00:00","modified_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99073","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99073","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}