CVE-2026-99070

fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.

Remove the warning. The existing error path still frees the skb and reports the error to listeners.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99070.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

907eea486888cfe118c19759bbc4b8fca2e004df

Fixed

dac2b0328495971c7b417fd0143e53643343936e

Fixed

24b2c95a046e15c9504a6d672b6b0b252952493f

Fixed

8a3b935b6b6037eefb36bd27a60793a008358e8d

Fixed

7b112bd43f1172fb152e848570a957467008a5ae

Fixed

4ac7d92a4698e34e614c254359665b9de1f65283

Fixed

291fe0bafee78c95f9f2e7f579f17793fd5a1e5a

Fixed

c97426ec649d99596d8969e1a052c16b14b7b485

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99070.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.12.0

Fixed

5.15.224

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.191

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.160

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.113

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.57

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.2.11

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99070.json"