In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes… (CVE-2026-99070)

The vulnerability concerns the IPv6 route notification mechanism in the Linux kernel, specifically in fib6_info_hw_flags_set(). This function sizes a socket buffer (skb) with rt6_nlmsg_size() and later fills it with rt6_fill_node(). When nexthop compatibility mode is enabled, a concurrent replacement can increase the group size between these two operations. As a result, rt6_fill_node() may return -EMSGSIZE legitimately, but the kernel previously issued a warning incorrectly suggesting a sizing bug. The fix removes this warning, relying on the existing error path that frees the skb and reports the error to listeners, thus resolving the confusion without changing error handling behavior.

The impact is limited to misleading kernel warnings about route notification size races in IPv6. There is no indication of a security breach, denial of service, or code execution risk. The fix removes false-positive warnings without altering the error handling, so the vulnerability does not appear to pose a direct security threat.

A fix has been applied to the Linux kernel to remove the incorrect warning. Since the existing error handling remains intact and no exploit is known, no additional action is required beyond updating to the fixed kernel version once available. Patch status is not explicitly confirmed; users should monitor vendor advisories for the official fix.