CVE-2026-74657

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops<br /> <br /> fib_nlmsg_size() still estimates nexthop space as if every gateway is<br /> encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an<br /> IPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.<br /> <br /> As a result, route notifications can allocate an skb that is too small.<br /> fib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the<br /> WARN_ON() that marks such failures as a fib_nlmsg_size() bug. With<br /> panic_on_warn set, this becomes a kernel panic.<br /> <br /> Mirror the actual nexthop dump layout in fib_nlmsg_size(): account for<br /> IPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop<br /> layout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is<br /> actually present.