CVE-2026-98303

A flaw was found in the Linux kernel's IPv4 networking subsystem. When looking up routes to send Internet Control Message Protocol (ICMP) error messages, the kernel fails to properly reject unreachable input routes. A remote attacker can exploit this flaw by transmitting network packets that trigger ICMP responses to unreachable destinations, causing the system to invoke an invalid route handler and trigger a kernel warning, potentially leading to a Denial of Service (DoS).

A flaw in the Linux kernel's IPv4 ICMP error-message routing is rated Moderate by Red Hat Product Security and affects the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels (including kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS layers of OpenShift Container Platform 4 and 5. When the kernel generates an ICMP error response and the forward output route cannot be used, icmp_route_lookup() falls back to a reverse-path lookup that calls ip_route_input() on the original packet's source address. For unreachable source addresses, this lookup can succeed and return an RTN_UNREACHABLE input route whose output callback is ip_rt_bug(); because the existing check only rejected RTN_LOCAL routes, the invalid route can be used for output, triggering a WARN_ON_ONCE() in ip_rt_bug() and dropping the outgoing ICMP response. An attacker who can transmit crafted IPv4 packets that cause the kernel to generate ICMP error replies toward unreachable destinations can trigger this condition and cause a denial of service: under default configurations the effect is a kernel warning and a dropped packet, while systems configured with panic_on_warn can panic. Red Hat Enterprise Linux 6 is out of support (OOSS) and will not receive a fix. For all affected streams the fix is deferred to a future update; the residual risk is limited to availability, with no impact on confidentiality or integrity. The Red Hat severity (Moderate, CVSS 3.1 score 5.5, local attack vector) reflects that the publicly demonstrated reproducer requires local privileges to set up the triggering configuration, although a remotely transmitted trigger remains plausible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.