Strix
73.2K

CVE-2026-99072

UnknownEPSS 0.16%

Last modified

CVE-2026-99072 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. Stop sizing when the indexed path is absent. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.

Metrics

EPSS Probability
0.16%

4.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 680aea08e78c003292415518ad270bc20f9c80b1, < 96f3fbb8575593657c7e80786dc3251d2fe3931b; >= 680aea08e78c003292415518ad270bc20f9c80b1, < 81f0deb02a5b5477f236bbbaed1149b779a8632b; >= 680aea08e78c003292415518ad270bc20f9c80b1, < 72d9d17092bb37b0717f12042a0817d01a1f9e78; >= 680aea08e78c003292415518ad270bc20f9c80b1, < ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54; >= 680aea08e78c003292415518ad270bc20f9c80b1, < c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49; >= 680aea08e78c003292415518ad270bc20f9c80b1, < ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88; >= 680aea08e78c003292415518ad270bc20f9c80b1, < d3daa33c7af92e38f2274bbd2576f58bfbaf89e6
LinuxLinux5.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99072?
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.
How severe is CVE-2026-99072?
Severity scoring for CVE-2026-99072 is pending analysis. The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99072?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99072?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST