In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read… (CVE-2026-98485)

The Linux kernel netfilter ip6t_rt module contained a vulnerability where the function rt_mt6_check() permitted rules with rtinfo->addrnr set to zero even when address matching was requested. In the IP6T_RT_FST_NSTRICT path, the loop in rt_mt6() could increment the index variable beyond the allowed bounds when processing packet routing addresses, leading to out-of-bounds reads beyond the ip6t_rt structure. This could trigger kernel memory safety checks or cause kernel panics. The fix involved rejecting rules with zero addrnr when address matching is requested and adjusting the loop termination condition to prevent out-of-bounds access.

This vulnerability could lead to kernel panics or memory safety violations (such as UBSAN/KASAN warnings) when processing crafted IPv6 packets, potentially causing denial of service on affected systems. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to reject invalid rules and correct the loop logic to prevent out-of-bounds reads. Users should apply the official kernel updates that include this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or Linux kernel advisories for the exact fixed versions and update guidance.