CVE-2026-99070None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In the Linux kernel, the following vulnerability has been resolved:
ipv6: do not warn on route notification size race
fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and reports the error to listeners.
Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 8a3b935b6b6037eefb36bd27a60793a008358e8dLinux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 7b112bd43f1172fb152e848570a957467008a5aeLinux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 4ac7d92a4698e34e614c254359665b9de1f65283Linux >= 907eea486888cfe118c19759bbc4b8fca2e004df < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5aLinux >= 907eea486888cfe118c19759bbc4b8fca2e004df < c97426ec649d99596d8969e1a052c16b14b7b485Linux 5.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets