CVE-2026-98303
Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup When the forward output route cannot be used in icmp_route_lookup(), it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr, the original packet's source address. ip_route_input() only returns an error for truly invalid packets. For unreachable addresses it will succeed and return an input route whose dst.output is set to ip_rt_bug(). The existing check only rejects RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned and later used for output, syzkaller triggering a WARN_ON_ONCE() in ip_rt_bug() as bellow: ------------[ cut here ]------------ WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20 RIP: 0010:ip_rt_bug+0x14/0x20 Call Trace: ip_push_pending_frames+0xfa/0x100 __icmp_send+0x905/0xf10 ip_options_compile+0xc0/0xd0 ip_rcv_finish_core+0x321/0xae0 ip_rcv+0x1de/0x260 __netif_receive_skb_one_core+0x11a/0x130 netif_receive_skb+0x7b/0x260 tun_get_user+0x11bf/0x1c10 ------------[ cut here ]------------ Reject input route that is RTN_UNREACHABLE to fix it. The net warning is only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of a race condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-98303
EUVD
EUVD-2026-93288

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063
Linux Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063
Linux Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063
Linux Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063
Linux Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063
Linux Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063
Linux Linux 2.6.25

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves ICMP route handling where unreachable input routes are incorrectly processed. When a forward output route fails, the system attempts to use a reverse path by calling ip_route_input() on the original packet's source address. This can return an RTN_UNREACHABLE route type, which later triggers a kernel warning (WARN_ON_ONCE) in ip_rt_bug() due to improper handling of unreachable addresses.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv4 ICMP handling. Detection requires checking kernel logs for WARN_ON_ONCE() messages in ip_rt_bug() related to RTN_UNREACHABLE routes. Monitor system logs with commands like 'dmesg | grep ip_rt_bug' or 'journalctl -k | grep ip_rt_bug'.

Impact Analysis

This vulnerability could lead to kernel warnings or crashes when processing ICMP packets with unreachable routes. It may cause system instability or unexpected behavior in network operations, particularly in environments using tun/tap interfaces or custom networking configurations.

Compliance Impact

This vulnerability is a Linux kernel issue related to ICMP route handling that triggers a kernel warning. It does not directly impact data privacy, security controls, or compliance with standards like GDPR or HIPAA, as it is a network routing error rather than a data exposure or access control flaw.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If immediate patching is not possible, consider restricting ICMP traffic or disabling vulnerable services temporarily. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart