The Linux kernel's fib_nlmsg_size() function incorrectly estimated the size needed for route notifications by assuming all gateways were IPv4 RTA_GATEWAY attributes. However, IPv4 routes can include IPv6 gateways encoded as RTA_VIA attributes, which were not properly accounted for. This caused the kernel to allocate insufficient buffer space (skb), leading to fib_dump_info() failures with -EMSGSIZE and triggering WARN_ON() in rtmsg_fib(). When panic_on_warn is set, this results in a kernel panic. The fix involved updating fib_nlmsg_size() to correctly account for IPv6 nexthop gateways (RTA_VIA), the no-header rtnexthop layout inside RTA_MULTIPATH, and RTA_FLOW attributes only when present.

The vulnerability can cause kernel panics on systems with panic_on_warn enabled due to improper buffer size allocation for route notifications involving IPv6 gateways in IPv4 routes. This may lead to denial of service conditions but does not indicate direct code execution or privilege escalation.

A fix has been implemented in the Linux kernel to correct the size estimation in fib_nlmsg_size(). Users should apply the official kernel update that includes this fix. Since no vendor advisory or patch link is provided here, check the Linux kernel mailing lists or official kernel repositories for the patch and update guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.