1. Home
  2. Vulnerabilities
  3. CVE-2026-74657
0.0
NA
CVE-2026-74657
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA. As a result, route notifications can allocate an skb that is too small. fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With panic_on_warn set, this becomes a kernel panic. Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is actually present.

Details
INFO

Published Date :

Aug. 22, 2026, 4:16 p.m.

Last Modified :

Aug. 22, 2026, 4:16 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-74657 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

: Total Affected Vendor : 0 | Products : 0
Solution
Update the Linux kernel to correctly calculate network route message buffer sizes.
  • Apply the Linux kernel patch for ipv4: Fix fib_nlmsg_size().
  • Update the Linux kernel to the patched version.
  • Reboot the system after applying kernel updates.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-74657.

URL Resource
https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385
https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295
https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397
https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324
https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3
https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395
https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-74657 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-74657 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-74657 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-74657 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 22, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd15662682db232da77136cd348f4c9df312ca6f9', 'lessThan': '0f0ca602941d0a81ae9514943ca06c55159c6385', 'versionType': 'git'}, {'status': 'affected', 'version': 'd15662682db232da77136cd348f4c9df312ca6f9', 'lessThan': '5307a53599fa762c06e475ee4a375252074fd324', 'versionType': 'git'}, {'status': 'affected', 'version': 'd15662682db232da77136cd348f4c9df312ca6f9', 'lessThan': '7f80ad373ce4a7af5367ff273cea0f16e91387f3', 'versionType': 'git'}, {'status': 'affected', 'version': 'd15662682db232da77136cd348f4c9df312ca6f9', 'lessThan': '4a5dfbae5179f6574695012a980476254df2d295', 'versionType': 'git'}, {'status': 'affected', 'version': 'd15662682db232da77136cd348f4c9df312ca6f9', 'lessThan': 'a59edda6eda1252340354322d8ab318b2e9052fb', 'versionType': 'git'}, {'status': 'affected', 'version': 'd15662682db232da77136cd348f4c9df312ca6f9', 'lessThan': '9b22f13524fa0de0d963bbd3002df6c28bae3395', 'versionType': 'git'}, {'status': 'affected', 'version': 'd15662682db232da77136cd348f4c9df312ca6f9', 'lessThan': '4ff9548d84945d2cbf9e4c207288063a200ea397', 'versionType': 'git'}], 'programFiles': ['net/ipv4/fib_semantics.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.216', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv4/fib_semantics.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA. As a result, route notifications can allocate an skb that is too small. fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With panic_on_warn set, this becomes a kernel panic. Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is actually present.
    Added Reference https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385
    Added Reference https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295
    Added Reference https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397
    Added Reference https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324
    Added Reference https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3
    Added Reference https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395
    Added Reference https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.