CVE-2026-98278 net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
A local high-privilege user can trigger a kernel warning and potential denial of service by configuring specific network tunnel routing loops.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98278?
CVE-2026-98278 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the route to the tunnel's remote endpoint and set ctx->dev to its device, which is the tunnel itself when that route resolves back to the tunnel. dev_fill_forward_path() then makes no progress and trips WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to offload a flow through the tunnel. That routing loop is a configuration any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and ip6_tnl_xmit() already treat it as a tx error, so remove the warning and just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE when accessing forward path array") did for the path stack overflow.
Which versions are affected by CVE-2026-98278?
How do I fix CVE-2026-98278?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98278 being exploited?
There is no known exploitation of CVE-2026-98278 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98278, GHSA-6vfc-qfc9-vf68, UBUNTU-CVE-2026-98278.