{"id":"CVE-2026-99070","title":"ipv6: do not warn on route notification size race","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node().  With nexthop c…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 8a3b935b6b6037eefb36bd27a60793a008358e8d","Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 7b112bd43f1172fb152e848570a957467008a5ae","Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 4ac7d92a4698e34e614c254359665b9de1f65283","Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5a","Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < c97426ec649d99596d8969e1a052c16b14b7b485","Linux 5.12"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:23:13.342Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99070","references":[{"url":"https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d"},{"url":"https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae"},{"url":"https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283"},{"url":"https://git.kernel.org/stable/c/291fe0bafee78c95f9f2e7f579f17793fd5a1e5a"},{"url":"https://git.kernel.org/stable/c/c97426ec649d99596d8969e1a052c16b14b7b485"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.516Z","slug":"CVE-2026-99070","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node().  With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots.  rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning.  The existing error path still frees the skb and\nreports the error to listeners.\n\n## Affected\n\n- `Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 8a3b935b6b6037eefb36bd27a60793a008358e8d`\n- `Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 7b112bd43f1172fb152e848570a957467008a5ae`\n- `Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 4ac7d92a4698e34e614c254359665b9de1f65283`\n- `Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5a`\n- `Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < c97426ec649d99596d8969e1a052c16b14b7b485`\n- `Linux 5.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}