Bug 2559824 (CVE-2026-99070) - CVE-2026-99070 kernel: ipv6: do not warn on route notification size race
Summary: CVE-2026-99070 kernel: ipv6: do not warn on route notification size race
Keywords:
Status: NEW
Alias: CVE-2026-99070
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-23 13:48 UTC by OSIDB Bzimport
Modified: 2026-10-26 11:23 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-23 13:48:10 UTC
In the Linux kernel, the following vulnerability has been resolved:

ipv6: do not warn on route notification size race

fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later
fills it with rt6_fill_node().  With nexthop compatibility mode enabled,
a concurrent replacement can grow the group between these independent
snapshots.  rt6_fill_node() can then legitimately return -EMSGSIZE, so
the warning does not prove a sizing bug.

Remove the warning.  The existing error path still frees the skb and
reports the error to listeners.


Note You need to log in before you can comment on or make changes to this bug.