CVE-2026-98031: nexthop: Initialize extack in remove_nh_grp_entry()
In the Linux kernel, the following vulnerability has been resolved:
nexthop: Initialize extack in removenhgrpentry()
removenhgrpentry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer.
Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nhresbucketmigrate()").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6347c5314cee
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
A nexthop group must be reduced, and a listener must fail while replacing that reduced group. The described trigger is an allocation failure from a listener that returns an error without setting an extack message.
Which listeners are specifically identified as affected by this failure mode?
netdevsim and mlxsw are identified as listeners that do not set an extack message when an allocation fails. In that situation, printing the message can dereference an uninitialized stack pointer.
What can be done if the kernel update cannot be applied immediately?
The provided information does not describe a configuration workaround. Reducing exposure would require avoiding the affected nexthop-group reduction path together with listener allocation failures until the fix is applied.