CVE-2026-74657

A flaw was found in the Linux kernel. The fib_nlmsg_size() function, which estimates the size for network message buffers, incorrectly calculates the required space for nexthops when IPv4 routes contain an IPv6 gateway. This error can lead to the allocation of an undersized buffer for route notifications. As a result, the system may experience a kernel panic, leading to a Denial of Service (DoS).

A moderate impact flaw was found in the Linux kernel's IPv4 routing (FIB) netlink code. The fib_nlmsg_size() function underestimates the buffer space needed for route notifications when an IPv4 route carries an IPv6 gateway, which is dumped as an RTA_VIA nexthop attribute instead of the expected RTA_GATEWAY form. An undersized skb can therefore be allocated, causing fib_dump_info() to fail with -EMSGSIZE and hit the rtmsg_fib() WARN_ON(); on systems where panic_on_warn is enabled, this results in a kernel panic and a denial of service. Triggering the flaw requires local access with the privileges needed to install or dump the specific route configuration (for example CAP_NET_ADMIN with IPv4 routes using IPv6 nexthop gateways), which limits exposure to availability only. Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 kernel and kernel-rt, and Red Hat In-Vehicle OS kernels, are affected; Red Hat Enterprise Linux 7 and 8 kernel and kernel-rt are not affected because the vulnerable code is not present in those streams. The fix for the affected streams is currently deferred to a future update; the residual risk is a local denial of service by a privileged user able to create the specific IPv4 route configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.