Executive brief
The Linux kernel's IPv4 routing subsystem miscalculates the buffer size needed for route notification messages, particularly when IPv6 gateways are used with IPv4 routes. This causes network configuration changes to crash the system with a kernel panic when warning-on-panic is enabled, disrupting network operations and system stability.
Technical details
The vulnerability is a buffer size calculation error in fib_nlmsg_size() that incorrectly estimates memory requirements for routing notifications. When IPv4 routes include IPv6 gateways (encoded as RTA_VIA attributes), the function allocates insufficient socket buffer space. This causes fib_dump_info() to fail with -EMSGSIZE, triggering a WARN_ON() assertion in rtmsg_fib(). With panic_on_warn enabled, this results in kernel panic. The fix mirrors the actual nexthop dump layout by properly accounting for IPv6 gateways, RTA_MULTIPATH structure, and RTA_FLOW attributes. The patch is available in upstream kernel commit 4ff9548d84945d2cbf9e4c207288063a200ea397 and has been backported to stable kernels.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 7.2
Timeline
- 2026-08-22: disclosed
- 2026-07-30: patched: Upstream fix committed