CVE-2026-98303: Linux Kernel ICMP Route Lookup DoS Flaw

CVE-2026-98303 Overview

CVE-2026-98303 is a Linux kernel vulnerability in the IPv4 ICMP subsystem. The flaw resides in icmp_route_lookup(), which fails to reject input routes of type RTN_UNREACHABLE during reverse-path lookup. When ip_route_input() returns an unreachable route, the kernel assigns dst.output to ip_rt_bug(), triggering a WARN_ON_ONCE() when the route is later used for output. Syzkaller reproduced the warning through crafted packets delivered via tun_get_user(), surfacing the issue in net/ipv4/route.c:1273. The maintainers resolved the issue by rejecting RTN_UNREACHABLE input routes in icmp_route_lookup().

Critical Impact
Local or network-adjacent attackers can trigger kernel warnings and potential denial-of-service conditions by sending crafted packets that force the ICMP code path through an unreachable reverse route.

Affected Products

Linux kernel IPv4 networking stack (net/ipv4/icmp.c, net/ipv4/route.c)
Upstream Linux kernel versions prior to the fix commits listed in the stable tree
Downstream distributions shipping the vulnerable icmp_route_lookup() logic

Discovery Timeline

2026-10-06 - CVE-2026-98303 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-98303

Vulnerability Analysis

The flaw is a kernel input-validation defect in the ICMP route lookup path. When the forward output route cannot be used, icmp_route_lookup() enters a reverse path and calls ip_route_input() on fl4_dec.daddr, which is the original packet's source address. ip_route_input() only returns an error for truly invalid packets. For unreachable destinations it succeeds and returns an input route whose dst.output handler points to ip_rt_bug(). The pre-fix validation only filtered RTN_LOCAL routes, allowing RTN_UNREACHABLE routes to flow into subsequent output operations. Downstream callers such as ip_push_pending_frames() then invoke dst.output, which triggers a WARN_ON_ONCE() inside ip_rt_bug() and taints the kernel log with repeated stack traces.

Root Cause

The root cause is incomplete route-type filtering in icmp_route_lookup(). The function treats any non-error, non-local route as safe for output, yet RTN_UNREACHABLE routes carry a sentinel dst.output that must never be invoked. This is an improper input validation defect in a kernel networking primitive.

Attack Vector

A local attacker with the ability to inject packets through a TUN/TAP device, or a network peer able to deliver IPv4 traffic eliciting an ICMP response toward an unreachable source, can force the vulnerable code path. The syzkaller reproducer uses tun_get_user() to inject the triggering frame, after which ip_rcv() and __icmp_send() reach ip_push_pending_frames() and dispatch the bogus output route. Successful triggering produces a kernel warning rather than memory corruption, but repeated invocation can degrade system reliability and spam kernel ring buffers.

No verified exploit code available. Refer to the upstream patches for
the precise code modification in icmp_route_lookup().

Detection Methods for CVE-2026-98303

Indicators of Compromise

Kernel log entries containing WARNING: net/ipv4/route.c with the symbol ip_rt_bug+0x14/0x20 in the backtrace
Repeated stack traces listing __icmp_send, ip_push_pending_frames, and ip_rcv_finish_core
Unexpected ICMP traffic patterns originating from or destined for unreachable network ranges

Detection Strategies

Monitor dmesg and /var/log/kern.log for ip_rt_bug warnings and correlate with packet capture around the same timestamps
Audit kernel versions against the fixed commits (06083ce, 1af2d87, 2998147, 83aa83f, cac69c5, fda3000) in the stable tree
Enable kernel tracepoints on fib:fib_table_lookup to flag frequent lookups returning RTN_UNREACHABLE

Monitoring Recommendations

Forward kernel ring buffer events to centralized logging and alert on WARN_ON_ONCE entries from net/ipv4/route.c
Track TUN/TAP interface usage on multi-tenant hosts, since tun_get_user() is the demonstrated injection vector
Baseline ICMP error volumes per host and alert on sudden spikes that coincide with kernel warnings

How to Mitigate CVE-2026-98303

Immediate Actions Required

Apply the upstream Linux kernel patches that reject RTN_UNREACHABLE input routes inside icmp_route_lookup()
Update to a distribution kernel that incorporates one of the stable backport commits listed in the references
Restrict unprivileged access to TUN/TAP device creation on shared systems until patched kernels are deployed

Patch Information

The fix is distributed across multiple stable branches. See the upstream commits: Kernel Git Commit 06083ce, Kernel Git Commit 1af2d87, Kernel Git Commit 2998147, Kernel Git Commit 83aa83f, Kernel Git Commit cac69c5, and Kernel Git Commit fda3000. Each commit adds an explicit check that rejects RTN_UNREACHABLE routes returned by ip_route_input().

Workarounds

Remove the CAP_NET_ADMIN capability from untrusted users to prevent arbitrary TUN/TAP packet injection
Deploy host firewall rules to drop inbound IPv4 traffic sourced from or destined to known unreachable prefixes
Rate-limit ICMP error generation using net.ipv4.icmp_ratelimit and net.ipv4.icmp_ratemask sysctls to reduce exposure

bash

# Configuration example: restrict ICMP error generation and TUN access
sysctl -w net.ipv4.icmp_ratelimit=1000
sysctl -w net.ipv4.icmp_ratemask=6168
setcap -r /usr/bin/<tun-wrapper-binary> 2>/dev/null || true
# Verify kernel includes the fix after patching
grep -R "RTN_UNREACHABLE" /usr/src/linux/net/ipv4/icmp.c