CVE-2026-98303

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

When the forward output route cannot be used in icmp_route_lookup(),

it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr,

the original packet's source address.

ip_route_input() only returns an error for truly invalid packets. For

unreachable addresses it will succeed and return an input route whose

dst.output is set to ip_rt_bug(). The existing check only rejects

RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned

and later used for output, syzkaller triggering a WARN_ON_ONCE()

in ip_rt_bug() as bellow:

------------[ cut here ]------------

WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20

RIP: 0010:ip_rt_bug+0x14/0x20

Call Trace:

ip_push_pending_frames+0xfa/0x100

__icmp_send+0x905/0xf10

ip_options_compile+0xc0/0xd0

ip_rcv_finish_core+0x321/0xae0

ip_rcv+0x1de/0x260

__netif_receive_skb_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References