CVE-2026-99072 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux-based systems should assess exposure and prioritize patching. This includes teams managing Linux kernel implementations, network operators, and security personnel responsible for vulnerability management and incident response.

Why it matters

A vulnerability in the Linux kernel's IPv4 implementation allows for a potential denial of service when handling route notifications. Linux kernel developers and maintainers, network administrators, and security teams should assess exposure and prioritize patching.

• Denial of service attacks may be attempted against vulnerable Linux kernel implementations.
• Successful exploitation requires network access and may lead to system crashes or instability.
• Verify and apply patches to ensure the vulnerability is addressed, prioritizing Linux kernel updates.
• Monitor system logs and network traffic for potential attack attempts.

Technical summary

The vulnerability is caused by the fib_nexthop_nlmsg_size() function not properly handling cases where a nexthop group shrinks during asynchronous hardware flag notifications. This can lead to a NULL pointer dereference. The issue has been resolved through a series of commits, including 96f3fbb8575593657c7e80786dc3251d2fe3931b and 81f0deb02a5b5477f236bbbaed1149b779a8632b. Affected Linux kernel developers and maintainers should assess exposure and prioritize patching. The vulnerability has a medium defensive priority and requires network access to exploit.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to ensure the vulnerability is addressed.
• Monitor network traffic and system logs for potential denial of service attempts.
• Consider implementing additional security measures, such as rate limiting or access controls, to mitigate the impact of a potential attack.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the fib_nexthop_nlmsg_size() function not properly handling cases where a nexthop group shrinks during asynchronous hardware flag notifications. This can lead to a NULL pointer dereference. The issue has been resolved through a series of commits, including 96f3fbb8575593657c7e80786dc3251d2fe3931b, 81f0deb02a5b5477f236bbbaed1149b779a8632b, and others.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.