CVE-2026-74657 ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
A local attacker can trigger a kernel panic by causing a route notification size mismatch, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74657?
CVE-2026-74657 is a denial of service vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.
As a result, route notifications can allocate an skb that is too small. fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With panic_on_warn set, this becomes a kernel panic.
Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is actually present.
Which versions are affected by CVE-2026-74657?
How do I fix CVE-2026-74657?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74657 being exploited?
There is no known exploitation of CVE-2026-74657 in the wild and no public exploit code.
Sources
Also known as AZL-97278, BELL-CVE-2026-74657, DEBIAN-CVE-2026-74657, GHSA-9gv9-cg8w-rc25, UBUNTU-CVE-2026-74657.