CVE-2026-45847: net: remove WARN_ON_ONCE when accessing forward path array
In the Linux kernel, the following vulnerability has been resolved:
net: remove WARNONONCE when accessing forward path array
Although unlikely, recent support for IPIP tunnels increases chances of reaching this WARNONONCE if userspace manages to build a sufficiently long forward path.
Remove it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.170-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.18.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.202 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.165 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.128 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.75 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.14 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45847?
The severity of CVE-2026-45847 is rated as 5.
What are the potential risks associated with CVE-2026-45847?
CVE-2026-45847 could potentially lead to unexpected behavior when accessing the forward path array in the Linux kernel.
How do I fix CVE-2026-45847?
To fix CVE-2026-45847, ensure that your Linux kernel is updated to the latest patched version released after May 27, 2026.
Which software is affected by CVE-2026-45847?
CVE-2026-45847 affects the Linux Foundation Linux Kernel.
Has CVE-2026-45847 been resolved?
Yes, CVE-2026-45847 has been resolved by removing the WARN_ON_ONCE when accessing the forward path array.