{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74657", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.923Z", "datePublished": "2026-08-22T15:32:31.458Z", "dateUpdated": "2026-08-27T12:39:57.259Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:39:57.259Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\n\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\n\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\n\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_semantics.c"], "versions": [{"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "0f0ca602941d0a81ae9514943ca06c55159c6385", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "5307a53599fa762c06e475ee4a375252074fd324", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "7f80ad373ce4a7af5367ff273cea0f16e91387f3", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "4a5dfbae5179f6574695012a980476254df2d295", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "a59edda6eda1252340354322d8ab318b2e9052fb", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "9b22f13524fa0de0d963bbd3002df6c28bae3395", "status": "affected", "versionType": "git"}, {"version": "d15662682db232da77136cd348f4c9df312ca6f9", "lessThan": "4ff9548d84945d2cbf9e4c207288063a200ea397", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_semantics.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.267", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.10.267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28"}, {"url": "https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385"}, {"url": "https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324"}, {"url": "https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3"}, {"url": "https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295"}, {"url": "https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb"}, {"url": "https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395"}, {"url": "https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397"}], "title": "ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/fib_semantics.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "0f0ca602941d0a81ae9514943ca06c55159c6385", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "5307a53599fa762c06e475ee4a375252074fd324", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "7f80ad373ce4a7af5367ff273cea0f16e91387f3", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "4a5dfbae5179f6574695012a980476254df2d295", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "a59edda6eda1252340354322d8ab318b2e9052fb", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "9b22f13524fa0de0d963bbd3002df6c28bae3395", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}, {"lessThan": "4ff9548d84945d2cbf9e4c207288063a200ea397", "status": "affected", "version": "d15662682db232da77136cd348f4c9df312ca6f9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/fib_semantics.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.267", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\n\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\n\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\n\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present."}], "id": "CVE-2026-74657", "lastModified": "2026-08-27T13:18:36.153", "metrics": {}, "published": "2026-08-22T16:16:39.333", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops", "id": "2521393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521393"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present.", "A flaw was found in the Linux kernel. The `fib_nlmsg_size()` function, which estimates the size for network message buffers, incorrectly calculates the required space for nexthops when IPv4 routes contain an IPv6 gateway. This error can lead to the allocation of an undersized buffer for route notifications. As a result, the system may experience a kernel panic, leading to a Denial of Service (DoS)."], "name": "CVE-2026-74657", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74657\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74657\nhttps://lore.kernel.org/linux-cve-announce/2026082227-CVE-2026-74657-70ac@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,0f0ca602941d0a81ae9514943ca06c55159c6385)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,5307a53599fa762c06e475ee4a375252074fd324)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,7f80ad373ce4a7af5367ff273cea0f16e91387f3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,4a5dfbae5179f6574695012a980476254df2d295)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,a59edda6eda1252340354322d8ab318b2e9052fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,9b22f13524fa0de0d963bb3002df6c28bae3395)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d15662682db232da77136cd348f4c9df312ca6f9,4ff9548d84945d2cbf9e4c207288063a200ea397)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.733473+00:00", "updated": "2026-08-25T15:30:05.658331+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}