UNKNOWN NVD
CVE-2026-74657
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops fib_nlmsg_size() still estimates nexthop s
In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
fib_nlmsg_size() still estimates nexthop space as if every gateway is
encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an
IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.
As a result, route notifications can allocate an skb that is too small.
fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the
WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With
panic_on_warn set, this becomes a kernel panic.
Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for
IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop
layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is
actually present.
References
- https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385
- https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295
- https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397
- https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324
- https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3
This unknown severity vulnerability was published on 2026-08-22 via NVD.
vulnfeed aggregates 11022 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.