CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CVE-2026-74657

mediumCVSS 4.4covered by 2 sourcesfirst seen 2026-08-11
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA. As a result, route notifications can allocate an skb that is too small. fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With panic_on_warn set, this becomes a kernel panic. Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is actually present.

CSIRTS triage

What
Incorrect buffer size calculation in fib_nlmsg_size() for RTA_VIA nexthops leaks kernel memory.
Who is affected
Systems running Linux kernel with IPv4 routing and RTA_VIA nexthop configuration.
Urgency
Medium severity (CVSS 4.4) information disclosure; not currently exploited.
Action
Update to patched Linux kernel version containing the fib_nlmsg_size RTA_VIA fix.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-74657

Get an email if CVE-2026-74657 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Advisory coverage (2)

External references

NVD record for CVE-2026-74657

CVE.org record

Embed the live status

CVE-2026-74657 live status badge — this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-74657 status](https://www.csirts.com/badge/CVE-2026-74657)](https://www.csirts.com/cve/CVE-2026-74657)