SECURITY ANNOUNCEMENT

CVE-2026-99072

23 October 2026

fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.

Introduced

5.12680aea08e78c003292415518ad270bc20f9c80b1

Fixed releases

6.12.113ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54

6.18.57c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49

6.6.16072d9d17092bb37b0717f12042a0817d01a1f9e78

7.2.11ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88

7.3d3daa33c7af92e38f2274bbd2576f58bfbaf89e6

View source announcement ↗