CVE-2026-74657
In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
fib_nlmsg_size() still estimates nexthop space as if every gateway is
encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an
IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.
As a result, route notifications can allocate an skb that is too small.
fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the
WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With
panic_on_warn set, this becomes a kernel panic.
Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for
IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop
layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is
actually present.
CSIRTS triage
- What
- Incorrect buffer size calculation in fib_nlmsg_size() for RTA_VIA nexthops leaks kernel memory.
- Who is affected
- Systems running Linux kernel with IPv4 routing and RTA_VIA nexthop configuration.
- Urgency
- Medium severity (CVSS 4.4) information disclosure; not currently exploited.
- Action
- Update to patched Linux kernel version containing the fib_nlmsg_size RTA_VIA fix.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-74657
Get an email if CVE-2026-74657 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownCVE-2026-74657: In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size()…nvd · 2026-08-22
- mediumCVE-2026-74657: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthopsmsrc · 2026-08-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-74657)