CVE-2026-98278

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check

ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the

route to the tunnel's remote endpoint and set ctx->dev to its device,

which is the tunnel itself when that route resolves back to the tunnel.

dev_fill_forward_path() then makes no progress and trips

WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to

offload a flow through the tunnel. That routing loop is a configuration

any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and

ip6_tnl_xmit() already treat it as a tx error, so remove the warning and

just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE

when accessing forward path array") did for the path stack overflow.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References