CVE-2026-74657: Linux Kernel IPv4 Routing DOS Vulnerability

CVE-2026-74657 Overview

CVE-2026-74657 is a Linux kernel vulnerability in the IPv4 Forwarding Information Base (FIB) netlink message sizing logic. The function fib_nlmsg_size() underestimates the size of route notifications when a nexthop uses an IPv6 gateway encoded as RTA_VIA instead of an IPv4 RTA_GATEWAY. This mismatch causes fib_dump_info() to fail with -EMSGSIZE, which triggers a WARN_ON() inside rtmsg_fib(). On systems configured with panic_on_warn, the warning escalates to a full kernel panic and denial of service. The bug affects local kernel networking behavior on hosts that install IPv4 routes with IPv6 nexthops.

Critical Impact
A local user or process able to install IPv4 routes with IPv6 nexthops can trigger a kernel WARN_ON(), causing a panic on systems with panic_on_warn enabled.

Affected Products

Linux kernel (upstream) — IPv4 FIB subsystem, fib_nlmsg_size()
Stable kernel branches referenced by the eight patch commits from git.kernel.org
Distributions shipping kernels that support IPv4 routes with IPv6 (RTA_VIA) gateways

Discovery Timeline

2026-08-22 - CVE-2026-74657 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74657

Vulnerability Analysis

The Linux IPv4 routing code sends netlink notifications when routes change. Before allocating the socket buffer, fib_nlmsg_size() calculates the required payload size. This calculation assumes each nexthop gateway is dumped as an IPv4 RTA_GATEWAY attribute of fixed size. Linux, however, supports IPv4 routes with IPv6 gateways, and fib_nexthop_info() encodes these as RTA_VIA attributes, which are larger and carry an address family header plus a 16-byte IPv6 address.

Because the size estimate is too small, nla_put() calls in fib_dump_info() return -EMSGSIZE. The caller rtmsg_fib() treats this as a programming bug and executes WARN_ON(). Hardened production kernels commonly set kernel.panic_on_warn=1, which converts the warning into a kernel panic. The result is a denial-of-service condition affecting the routing control plane and the host itself.

Root Cause

The root cause is an accounting mismatch [CWE-131-like] between the size estimator and the actual netlink dump path. fib_nlmsg_size() does not mirror the layout produced by fib_nexthop_info(): it omits the RTA_VIA case for IPv6 gateways, incorrectly accounts for the no-header rtnexthop layout used inside RTA_MULTIPATH, and unconditionally reserves space for RTA_FLOW even when the attribute is not emitted.

Attack Vector

The issue is reachable from any context that can install IPv4 routes with an IPv6 gateway, for example through RTM_NEWROUTE netlink messages issued by ip route add ... via inet6 <addr>. Route creation, replacement, or deletion generates notifications that traverse the buggy sizing path. On kernels without panic_on_warn, exploitation produces stack traces and failed notifications; with panic_on_warn enabled, exploitation crashes the host. No memory corruption or code execution primitive is described in the upstream commit message.

The upstream fix mirrors the actual dump layout inside fib_nlmsg_size(), accounting for RTA_VIA gateways, the multipath no-header rtnexthop layout, and conditional RTA_FLOW inclusion. See the kernel patches for details, for example Kernel Patch 0f0ca60 and Kernel Patch a59edda6.

Detection Methods for CVE-2026-74657

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating in rtmsg_fib or fib_dump_info with -EMSGSIZE return codes.
Unexpected kernel panics on hosts running with kernel.panic_on_warn=1 shortly after IPv4 route changes.
Netlink RTM_NEWROUTE or RTM_DELROUTE operations that include IPv6 via gateways preceding the crash.

Detection Strategies

Parse /var/log/kern.log, journalctl -k, or centralized syslog for stack frames referencing fib_dump_info, rtmsg_fib, and fib_nlmsg_size.
Audit installed kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts.
Correlate route-change audit events (iproute2, netlink socket activity) with kernel warnings to identify triggering workloads.

Monitoring Recommendations

Ship kernel ring-buffer output to a centralized logging or SIEM platform and alert on WARN_ON events in the FIB code path.
Track host uptime and unplanned reboots on routers, gateways, and container hosts that install IPv4 routes with IPv6 nexthops.
Monitor changes to kernel.panic_on_warn, sysctl files, and boot parameters that influence warning-to-panic behavior.

How to Mitigate CVE-2026-74657

Immediate Actions Required

Apply the vendor kernel update that includes the fib_nlmsg_size() fix for RTA_VIA nexthops on all affected stable branches.
Inventory hosts that use IPv4 routes with IPv6 gateways (ip -4 route show | grep -i via inet6) and prioritize them for patching.
Temporarily disable kernel.panic_on_warn on non-hardened workloads to avoid host crashes while patches are staged.

Patch Information

Upstream fixes are distributed across multiple stable branches. Reference commits include Kernel Patch 0f0ca60, Kernel Patch 4a5dfba, Kernel Patch 4ff9548, Kernel Patch 5307a53, Kernel Patch 57195f0, Kernel Patch 7f80ad3, Kernel Patch 9b22f13, and Kernel Patch a59edda6. Rebuild and reboot into a kernel that includes the corresponding commit for your branch.

Workarounds

Avoid installing IPv4 routes that use IPv6 gateways until patched kernels are deployed; use native IPv6 routes instead where feasible.
Restrict CAP_NET_ADMIN and access to AF_NETLINKNETLINK_ROUTE sockets to trusted administrators to limit who can trigger the code path.
Set kernel.panic_on_warn=0 on hosts where continued availability outweighs strict warning enforcement until the patch is applied.

bash

# Verify running kernel and route configuration
uname -r
ip -4 route show | grep -E 'via inet6|via .*:.*:'

# Temporarily prevent panic escalation from the WARN_ON
sysctl -w kernel.panic_on_warn=0

# Persist across reboots
echo 'kernel.panic_on_warn = 0' | sudo tee /etc/sysctl.d/99-cve-2026-74657.conf
sudo sysctl --system