CVE-2026-74657
Received Received - Intake

Heap Buffer Overflow in Linux Kernel IPv4 Routing

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA. As a result, route notifications can allocate an skb that is too small. fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With panic_on_warn set, this becomes a kernel panic. Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is actually present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74657
EUVD
EUVD-2026-64594

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect size estimation for route notifications when IPv6 gateways are used. The function fib_nlmsg_size() miscalculates the required buffer size by not accounting for IPv6 gateways encoded as RTA_VIA attributes, leading to buffer overflows and kernel panics if panic_on_warn is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv4 routing subsystem and may not have direct detection commands. Monitor kernel logs for WARN_ON() errors related to fib_nlmsg_size() or route notification failures. Check for kernel panics if panic_on_warn is enabled.

Impact Analysis

This vulnerability can cause kernel panics on affected Linux systems, leading to system crashes and potential denial of service. Systems using IPv6 gateways in routing configurations are particularly at risk.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this issue. If immediate patching is not possible, avoid using IPv4 routes with IPv6 gateways or complex nexthop configurations until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74657. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart