EUVD-2026-108739

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99073 ipv4: stop exception dump when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99073

The Linux kernel contains a vulnerability where an IPv4 Forwarding Information Base (FIB) dump could lead to a null pointer dereference. The issue occurs because fib_dump_info_fnhe() uses a loop bound that may become invalid if an RTM_NEWNEXTHOP operation replaces a nexthop group with fewer paths...

kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path

A flaw was found in the Linux kernel's IPv4 forwarding information base FIB component. A local attacker with administrative network capabilities CAPNETADMIN could exploit a timing issue during route insertion and lookup operations. This could lead to a "use-after-free" vulnerability, where the...

kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path

A flaw was found in the Linux kernel's IPv4 forwarding information base FIB component. A local attacker with administrative network capabilities CAPNETADMIN could exploit a timing issue during route insertion and lookup operations. This could lead to a "use-after-free" vulnerability, where the...

kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path

A flaw was found in the Linux kernel's IPv4 forwarding information base FIB component. A local attacker with administrative network capabilities CAPNETADMIN could exploit a timing issue during route insertion and lookup operations. This could lead to a "use-after-free" vulnerability, where the...

kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path

A flaw was found in the Linux kernel's IPv4 forwarding information base FIB component. A local attacker with administrative network capabilities CAPNETADMIN could exploit a timing issue during route insertion and lookup operations. This could lead to a "use-after-free" vulnerability, where the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: fib6rules: avoided possible NULL dereferencing in fib6ruleaction. syzbot is capable of triggering the following crashes 1, caused by the unsafe use of ip6dstidev. Indeed, ip6dstidev can return NULL, and this value must...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fixed a memory leak in nhcpcpurthoutput within fibchecknhv6gw. The function fibchecknhv6gw assumes that fib6nhinit will clean up everything when it fails. The commit 7dd73168e273 „ipv6: Always allocate pcpu memory in fib6nh...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv4: Prevent potential spectre v1 exploits in fibmetricsMatch if !type continue; if type RTAXMAX return false; ... fival = fi-fibmetrics-metricstype - 1; Since @type is used as an array index, we need to prevent CPU speculation ...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...

CVE-2026-97598

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

CVE-2026-97598

The Linux kernel contains a vulnerability in the ipv4: fib component where the fib_empty_table() function probes every table ID starting from 1 until a free one is found. In a dense set of IDs, this causes each probe to walk a growing hash chain while the RTNL is held. To mitigate this, the autom...

CVE-2026-97598 ipv4: fib: bound automatic table ID allocation

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

CVE-2026-97598: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

CVE-2026-97598: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

PT-2026-98538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv4 forwarding information base fib where the fib empty table function probes every table ID starting from 1 until a free one is found. Because IPv4 tables are...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv4: A reference count leak was fixed when using error routes with nexthop objects. When a nexthop object is deleted, it is marked as “dead”, and then fibtableFlush is called to flush all routes that use the dead nexthop. The...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ipv4: Handled attempts to delete multipath routes when the fibinfo contains a reference to nh. Gwangun Jung reported a buffer-overflow vulnerability in fibnhmatch: fibnhmatch+0xf98/0x1130;...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: A possible infinite loop has been fixed in fib6infousesdev. fib6infousesdev appears to rely on RCU without proper protection. Similar to the previous fix in rt6nlmsgsize, we need to ensure that fib6delroute or fib6addrt2nod...