In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet:… (CVE-2026-99073)

The Linux kernel vulnerability (CVE-2026-99073) arises from a race condition in the IPv4 FIB dump process introduced by commit 4ce5dc9316de. The function fib_dump_info_fnhe() uses fib_info_num_path() to determine loop bounds, but fib_info_nhc() reloads the nexthop group independently. If a RTM_NEWNEXTHOP message replaces a nexthop group with fewer paths between these calls, fib_info_nhc() returns NULL, leading to a NULL pointer dereference when accessing nhc_flags. The fix stops the walk when the indexed path is absent, preventing the exception dump.

The vulnerability could cause a kernel exception or crash due to NULL pointer dereference during IPv4 FIB dumps when nexthop groups shrink concurrently. This may lead to denial of service conditions on affected systems.

A fix has been implemented in the Linux kernel to stop the walk when the indexed path is absent, preventing the NULL pointer dereference. Users should apply the official kernel updates containing this fix once available. Patch status is not explicitly stated in the provided data; check the vendor or kernel maintainers' advisories for current remediation guidance.