{"apiVersion":"1.0","identifier":"CVE-2026-99072","description":"In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c (-net: ipv4: Emit notification when fib hardware flags are changed-) added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.","publishedAt":"2026-10-23T13:17:31","lastModifiedAt":"2026-10-30T13:21:43","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99072","cvssScore":null,"cvssVector":null,"epssProbability":0.00161,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99072","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99072","en":"https://www.redsauce.net/en/cves/CVE-2026-99072","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99072","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99072","de":"https://www.redsauce.net/de/cves/CVE-2026-99072","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99072","el":"https://www.redsauce.net/el/cves/CVE-2026-99072"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99072"}}