CVE-2026-98303
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063, < 06083cea4a3b95f5ebc85312f97d7086e6c9e782Upgrade to: 06083cea4a3b95f5ebc85312f97d7086e6c9e782Affected: ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063, < 83aa83f81a8fec30ff5372dee60b2f0561bcb2caUpgrade to: 83aa83f81a8fec30ff5372dee60b2f0561bcb2caAffected: ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063, < cac69c50716c712ef0114837c9427da66066124cUpgrade to: cac69c50716c712ef0114837c9427da66066124cAffected: ≥ 8b7817f3a959ed99d7443afc12f78a7e1fcc2063, < 1af2d87964d87ba7626d96928d68c09158b5a223Upgrade to: 1af2d87964d87ba7626d96928d68c09158b5a223 + 2 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup When the forward output route cannot be used in icmp_route_lookup(), it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr, the original packet's source address. ip_route_input() only returns an error for truly invalid packets. For unreachable addresses it will succeed and return an input route whose dst.output is set to ip_rt_bug(). The existing check only rejects RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned and later used for output, syzkaller triggering a WARN_ON_ONCE() in ip_rt_bug() as bellow: ------------[ cut here ]------------ WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20 RIP: 0010:ip_rt_bug+0x14/0x20 Call Trace: ip_push_pending_frames+0xfa/0x100 __icmp_send+0x905/0xf10 ip_options_compile+0xc0/0xd0 ip_rcv_finish_core+0x321/0xae0 ip_rcv+0x1de/0x260 __netif_receive_skb_one_core+0x11a/0x130 netif_receive_skb+0x7b/0x260 tun_get_user+0x11bf/0x1c10 ------------[ cut here ]------------ Reject input route that is RTN_UNREACHABLE to fix it. The net warning is only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of a race condition.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/06083cea4a3b95f5ebc85312f97d7086e6c9e782
- git.kernel.org/stable/c/83aa83f81a8fec30ff5372dee60b2f0561bcb2ca
- git.kernel.org/stable/c/cac69c50716c712ef0114837c9427da66066124c
And 3 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI