CVE-2026-98303: ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
In the Linux kernel, the following vulnerability has been resolved:
ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup
When the forward output route cannot be used in icmproutelookup(), it enters the "reverse path" and calls iprouteinput() on fl4dec.daddr, the original packet's source address.
iprouteinput() only returns an error for truly invalid packets. For unreachable addresses it will succeed and return an input route whose dst.output is set to iprtbug(). The existing check only rejects RTNLOCAL routes, so the RTNUNREACHABLE route types can still be returned and later used for output, syzkaller triggering a WARNONONCE() in iprtbug() as bellow:
------------[ cut here ]------------ WARNING: net/ipv4/route.c:1273 at iprtbug+0x14/0x20 RIP: 0010:iprtbug+0x14/0x20 Call Trace: ippushpendingframes+0xfa/0x100 icmpsend+0x905/0xf10 ipoptionscompile+0xc0/0xd0 iprcvfinishcore+0x321/0xae0 iprcv+0x1de/0x260 netifreceiveskbonecore+0x11a/0x130 netifreceiveskb+0x7b/0x260 tungetuser+0x11bf/0x1c10 ------------[ cut here ]------------
Reject input route that is RTNUNREACHABLE to fix it. The net warning is only printed for RTNLOCAL, as RTNUNREACHABLE is not the result of a race condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What network condition is required to trigger the warning?
The ICMP route lookup must fall back to reverse-path routing, and the lookup of the original packet source must return an RTN_UNREACHABLE input route. That route can then be incorrectly used for output, reaching ip_rt_bug().
How can administrators tell whether this has occurred?
The kernel logs a WARN_ON_ONCE() from ip_rt_bug() in net/ipv4/route.c:1273. The reported call path includes ip_push_pending_frames, __icmp_send, ip_options_compile, ip_rcv_finish_core, and ip_rcv; the supplied trace also includes tun_get_user.
What is the remediation described by the fix?
The fix rejects RTN_UNREACHABLE input routes in icmp_route_lookup() rather than allowing them to be returned for output use. The provided references identify stable kernel commits containing the correction.