CVE-2026-99070None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
ipv6: do not warn on route notification size race
fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and reports the error to listeners.
Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 8a3b935b6b6037eefb36bd27a60793a008358e8dLinux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 7b112bd43f1172fb152e848570a957467008a5aeLinux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 4ac7d92a4698e34e614c254359665b9de1f65283Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5aLinux >= 907eea486888cfe118c19759bbc4b8fca2e004df < c97426ec649d99596d8969e1a052c16b14b7b485Linux 5.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98987Nonenamespace: look at the topmost mount for a mount namespace file
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
CVE-2026-98988Nonenamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
CVE-2026-98991Nonenamespace: queue a mount only once for mount notifications