Description
In the Linux kernel, the following vulnerability has been resolved:

ipv6: do not warn on route notification size race

fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later
fills it with rt6_fill_node(). With nexthop compatibility mode enabled,
a concurrent replacement can grow the group between these independent
snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so
the warning does not prove a sizing bug.

Remove the warning. The existing error path still frees the skb and
reports the error to listeners.
Published: 2026-10-23
Score: 2.5 Low
EPSS: < 1% Very Low
KEV: No
Impact: No Direct Security Impact
Action: Monitor
AI Analysis

Impact

The described issue in the Linux kernel involves a race condition in the IPv6 routing logic that could previously trigger a warning when the size of a route notification message was incorrectly inferred. The bug was addressed by removing the misleading warning path; the underlying error handling still frees resources and notifies listeners when an invalid size occurs. Because the fix does not alter any kernel execution path that could be abused, there is no direct impact on confidentiality, integrity, or availability of the system.

Affected Systems

This bug was present in the general Linux kernel source tree and therefore affected all distributions that ship stock kernel code with the older IPv6 routing implementation. No exact kernel version range is provided in the advisory, so users should check whether their kernel contains the referenced patch commit identifiers. Both modules 'Linux:Linux' are listed among affected vendors.

Risk and Exploitability

Given that the vulnerability was a benign warning unrelated to malicious exploitation and no code execution path is introduced, the security risk is considered low. The CVSS score is 2.5, and the EPSS score is less than 1%; the advisory is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation is negligible. No known attack vector leverages this race condition for adversarial payloads, and the issue has been mitigated through the kernel update.

Generated by OpenCVE AI on October 27, 2026 at 10:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version that includes the patch resolving the IPv6 route notification size race
  • If the system relies on nexthop compatibility mode, evaluate whether it is essential and disable it if not needed to reduce the possibility of related race conditions.
  • Review the vendor’s release notes or patch list for any additional IPv6 routing updates after the fix.

Generated by OpenCVE AI on October 27, 2026 at 10:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-9018-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-9018-2 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-9019-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-9020-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-9022-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-9023-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-9024-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-9025-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-9026-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-9039-1 Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-9040-1 Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-9066-1 Linux kernel (HWE) vulnerabilities
History

Fri, 30 Oct 2026 13:00:00 +0000


Tue, 27 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-617
References
Metrics threat_severity

None

cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Low


Sat, 24 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux linux
Vendors & Products Linux linux

Fri, 23 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug. Remove the warning. The existing error path still frees the skb and reports the error to listeners.
Title ipv6: do not warn on route notification size race
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-30T12:41:29.857Z

Reserved: 2026-09-25T10:25:14.389Z

Link: CVE-2026-99070

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T13:17:30.907

Modified: 2026-10-30T13:21:43.290

Link: CVE-2026-99070

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99070 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:45:06Z

Weaknesses