CVE-2026-98278
Received Received - Intake

Linux Kernel Route Walk Loop Configuration Flaw

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the route to the tunnel's remote endpoint and set ctx->dev to its device, which is the tunnel itself when that route resolves back to the tunnel. dev_fill_forward_path() then makes no progress and trips WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to offload a flow through the tunnel. That routing loop is a configuration any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and ip6_tnl_xmit() already treat it as a tx error, so remove the warning and just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE when accessing forward path array") did for the path stack overflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98278
EUVD
EUVD-2026-93206

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux ab427db17885814069bae891834f20842f0ac3a4
Linux Linux ab427db17885814069bae891834f20842f0ac3a4
Linux Linux 6.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a warning trigger in the network stack when processing tunnel routes. A CAP_NET_ADMIN user can create a routing loop by configuring a tunnel to route back to itself. The dev_fill_forward_path() function then fails to progress and triggers a warning. The fix removes this warning and treats the loop as a normal error.

Detection Guidance

This vulnerability is related to a kernel warning triggered during route lookups in tunnel configurations. Detection would typically involve monitoring kernel logs for WARN_ON_ONCE messages related to dev_fill_forward_path() or tunnel routing loops. Check system logs with commands like dmesg | grep -i warn or journalctl -k | grep -i warn.

Impact Analysis

If exploited, this vulnerability could cause unnecessary warning logs in the kernel when network tunnels are misconfigured. It does not directly lead to security breaches but may indicate underlying configuration issues. Systems relying on flowtables for network offloading could experience unexpected behavior or errors.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations as it does not involve data breaches or unauthorized access. However, excessive warning logs or system instability could indirectly affect operational compliance by causing service disruptions or audit concerns.

Mitigation Strategies

Apply the latest Linux kernel updates to resolve this issue. If immediate patching is not possible, restrict CAP_NET_ADMIN capabilities to trusted users to prevent unauthorized tunnel configuration. Monitor kernel logs for related warnings as a sign of attempted exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart