CVE-2026-99072

A flaw was found in the Linux kernel's IPv4 networking subsystem. A local user with network administration privileges can trigger a race condition when updating routing nexthop configurations concurrently with route notifications, causing a NULL pointer dereference. This flaw can lead to a kernel crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact because exploitation requires local access, elevated network administration capabilities, and winning a specific race condition during routing configuration updates. Successful exploitation results only in a kernel crash causing a denial of service, without impacting data confidentiality or integrity. On typical Red Hat Enterprise Linux systems, unprivileged users cannot modify IPv4 routing tables or nexthop groups.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.