CVE-2026-98031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: Initialize extack in remove_nh_grp_entry()

remove_nh_grp_entry() prints the extack message when a listener fails

to replace the reduced nexthop group. However, extack is not

initialized and listeners are not required to set a message when

returning an error. Neither netdevsim nor mlxsw do so when an

allocation fails, resulting in the dereference of an uninitialized

stack pointer.

Fix by zero-initializing extack, as was done in commit 6347c5314cee

("nexthop: initialize extack in nh_res_bucket_migrate()").

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References