---
id: CVE-2026-99072
title: 'ipv4: stop route notification sizing when nexthop group shrinks'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: stop route notification sizing when nexthop group shrinks

  Commit 680aea08e78c ("net: ipv4: Emit notification when fib
  hardware flags are changed") added an RCU-o…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 <
    72d9d17092bb37b0717f12042a0817d01a1f9e78
  - >-
    Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 <
    ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54
  - >-
    Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 <
    c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49
  - >-
    Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 <
    ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88
  - >-
    Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 <
    d3daa33c7af92e38f2274bbd2576f58bfbaf89e6
  - Linux 5.12
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:23:15.735Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99072'
references:
  - url: 'https://git.kernel.org/stable/c/72d9d17092bb37b0717f12042a0817d01a1f9e78'
  - url: 'https://git.kernel.org/stable/c/ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54'
  - url: 'https://git.kernel.org/stable/c/c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49'
  - url: 'https://git.kernel.org/stable/c/ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88'
  - url: 'https://git.kernel.org/stable/c/d3daa33c7af92e38f2274bbd2576f58bfbaf89e6'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.515Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv4: stop route notification sizing when nexthop group shrinks

Commit 680aea08e78c ("net: ipv4: Emit notification when fib
hardware flags are changed") added an RCU-only fib_nlmsg_size() call
for asynchronous hardware flag notifications.

fib_nlmsg_size() checks fib_info_num_path() before each iteration,
then fib_info_nhc() independently reloads nh->nh_grp. If
RTM_NEWNEXTHOP replaces a group with fewer paths between those loads,
fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences
it.

Stop sizing when the indexed path is absent. Nexthop groups are
dense, so the current snapshot has no later path.

## Affected

- `Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 < 72d9d17092bb37b0717f12042a0817d01a1f9e78`
- `Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 < ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54`
- `Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 < c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49`
- `Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 < ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88`
- `Linux >= 680aea08e78c003292415518ad270bc20f9c80b1 < d3daa33c7af92e38f2274bbd2576f58bfbaf89e6`
- `Linux 5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.