CVE-2026-98278— net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已解决以下漏洞： 网络：从 的循环检查中移除 和 会查找指向隧道远端端点的路由，并将 设置为该路由对应的设备。当该路由解析回隧道本身时， 即为隧道设备。随后， 在此情况下无法取得进展，一旦有流表尝试通过该隧道卸载流处理，就会触发 警告。 这种路由环路是任何具备 权限的用户均可配置的情况，而 和 已将其视为传输错误进行处理。因此，应移除该警告，并像提交 008e7a7c293b（“net: remove WARN_ON_ONCE when accessing forward path arra
Possible ATT&CK Techniques 1 AI
T1498 · Network Denial of ServiceAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | ab427db17885814069bae891834f20842f0ac3a4< d8eb177632dacda28bc6130c2105afbf5b791eb0 |
affected |
ab427db17885814069bae891834f20842f0ac3a4< 150dba2c69e93302af24a0c868eebe4871e2e107 |
affected | ||
6.19 |
affected | ||
< 6.19 |
unaffected | ||
7.2.8≤ 7.2.* |
unaffected | ||
7.3-rc4≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98278
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the
route to the tunnel's remote endpoint and set ctx->dev to its device,
which is the tunnel itself when that route resolves back to the tunnel.
dev_fill_forward_path() then makes no progress and trips
WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to
offload a flow through the tunnel. That routing loop is a configuration
any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and
ip6_tnl_xmit() already treat it as a tx error, so remove the warning and
just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE
when accessing forward path array") did for the path stack overflow.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98278
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98278
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-98278 (2)
Same Patch Batch · Linux · 2026-10-06 · 208 CVEs total
| CVE-2026-98323 | 9.8 CRITICAL | RDMA/siw: Bound fragmented header copies by the remaining length |
| CVE-2026-98365 | 9.8 CRITICAL | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access |
| CVE-2026-98282 | 8.8 HIGH | powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba |
| CVE-2026-98283 | 8.8 HIGH | KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() |
| CVE-2026-98339 | 8.8 HIGH | wifi: cfg80211: don't filter by BSS type when removing stale entries |
| CVE-2026-98171 | 8.8 HIGH | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs |
| CVE-2026-98261 | 8.1 HIGH | cifs: Fix server use-after-free in cifs_chan_skip_or_disable() |
| CVE-2026-98357 | 8.1 HIGH | IB/isert: wait for deferred control PDU completions before releasing the connection |
| CVE-2026-98239 | 8.1 HIGH | net: lan743x: fix RX checksum use-after-free |
| CVE-2026-98341 | 7.8 HIGH | wifi: cfg80211: don't free driver-owned scan requests |
| CVE-2026-98324 | 7.8 HIGH | dmaengine: pxa: fix double counting of the hw descriptors |
| CVE-2026-98320 | 7.8 HIGH | netfilter: flowtable: hold reference on ct until flow is released |
| CVE-2026-98228 | 7.8 HIGH | mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| CVE-2026-98229 | 7.8 HIGH | xfrm: save input state data before secpath resets |
| CVE-2026-98318 | 7.8 HIGH | smb: client: validate absolute native symlink targets before NT fixups |
| CVE-2026-98315 | 7.8 HIGH | ntfs: protect runlist updates with the runlist lock |
| CVE-2026-98260 | 7.8 HIGH | exec: Cleanup POSIX timers right after de_thread() |
| CVE-2026-98256 | 7.8 HIGH | signal: Prevent exec() race |
| CVE-2026-98258 | 7.8 HIGH | posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list |
| CVE-2026-98254 | 7.8 HIGH | swiotlb: use the adjusted address for the highmem page lookup |
Showing top 20 of 208 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2026-98278
No comments yet