CVE-2026-98031

A flaw was found in the Linux kernel. When removing a nexthop routing group entry, an error path fails to properly initialize an error-reporting pointer, causing the kernel to dereference uninitialized stack memory. A local user with network administration privileges could exploit this flaw during memory allocation failures to cause a kernel crash, resulting in a Denial of Service (DoS).

A MODERATE severity flaw was found in the Linux kernel nexthop routing subsystem. When a nexthop group entry is removed, the error path in remove_nh_grp_entry() prints an extended acknowledgment (extack) message, but the extack structure is not initialized there, and nexthop listeners are not required to set an error message when they fail to replace a reduced nexthop group. Listeners such as netdevsim and mlxsw do not set a message when an allocation fails, so the kernel can dereference an uninitialized stack pointer and crash, resulting in a local denial of service. Exploitation requires local access with network administration privileges (CAP_NET_ADMIN) to manipulate nexthop objects, and triggering also depends on a listener failing an allocation or replacement, which limits practical exploitability. Red Hat Enterprise Linux 9 and 10, the Real Time kernel on affected Red Hat Enterprise Linux 9 streams, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping RHEL CoreOS 9 kernels are affected. Red Hat Enterprise Linux 6, 7, and 8 (including kernel-rt), and OpenShift Container Platform releases shipping RHEL CoreOS 8 are not affected because the vulnerable code is not present in those kernels. Because this issue can only be triggered locally by a privileged user under unlikely error-path conditions and its impact is limited to denial of service, the fix is currently deferred for the affected releases; the residual risk is that a local attacker with network administration privileges could crash an affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.