CVE-2026-98031

Overview

CVE-2026-98031 is a medium severity vulnerability in the Linux kernel's nexthop routing code. An uninitialized extack pointer can lead to a null pointer dereference when a listener fails to replace a reduced nexthop group. This flaw may cause a kernel crash or denial of service on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in remove_nh_grp_entry() remove_nh_grp_entry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer. Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nh_res_bucket_migrate()").

Impact

The flaw can lead to a denial of service by crashing the kernel, compromising availability. It does not directly expose confidentiality or integrity, but a crash can allow attackers to pivot or disrupt services. Defenders should monitor for kernel panics and ensure systems are patched.

Remediation

Apply the latest kernel update that includes commit 6347c5314cee which zero-initializes extack. If unable to update immediately, disable or restrict use of nexthop routing features or apply a temporary kernel parameter to limit nexthop group usage. Monitor kernel logs for extack-related panics.

Risk context

Medium severity with CVSS 5.5; no EPSS data available. While not critical, the potential for kernel crashes warrants timely patching, especially on production servers.

Affected products

• Linux kernel
• netdevsim
• mlxsw