CVE-2026-74657

The flaw lies in the kernel’s calculation of the memory needed for route notifications. Because IPv4 routes may carry an IPv6 gateway encoded as RTA_VIA, the size estimator assumes all gateways are IPv4, allocating a buffer that can be too small. When the dumper writes past this bound, the routine fails with –EMSGSIZE, triggers a WARN_ON(), and if the system is configured with panic_on_warn, a full kernel panic occurs. This results in an unprivileged local denial of service where the operating system becomes unreachable until reboot.

Any Linux kernel instance that processes IPv4 routes containing IPv6 nexthops before the issue is fixed. The affected code exists in Linux kernel releases older than the commit that corrected fib_nlmsg_size(); the vendor product is Linux kernel.

The CVSS score is 5.5, indicating moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must influence routing table updates, which typically requires root or kernel‑privileged access, or a misconfigured system that allows unprivileged route modification. If the system runs with panic_on_warn enabled, the failure will lead to a kernel panic, making the impact local but severe (system crash). The exploitability is modest, but the consequences are significant on affected systems.