CVE-2026-99073 ipv4: stop exception dump when nexthop group shrinks
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99073?
CVE-2026-99073 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop exception dump when nexthop group shrinks
Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement.
fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and the dump dereferences it through nhc_flags.
Stop the walk when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.
Which versions are affected by CVE-2026-99073?
How do I fix CVE-2026-99073?
Upgrade to a fixed version.
Is CVE-2026-99073 being exploited?
There is no known exploitation of CVE-2026-99073 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99073, DEBIAN-CVE-2026-99073, GHSA-4527-q5wc-xrv7, UBUNTU-CVE-2026-99073.