Is there a patch available for CVE-2026-98303?

Yes, a patch is available for CVE-2026-98303. Update the affected software to the latest version immediately.

Linux CVE-2026-98303

EUVD-2026-93288

2026-10-06 Linux

GHSA-hw8j-26f4-2863

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

When the forward output route cannot be used in icmp_route_lookup(), it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr, the original packet's source address.

ip_route_input() only returns an error for truly invalid packets. For unreachable addresses it will succeed and return an input route whose dst.output is set to ip_rt_bug(). The existing check only rejects RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned and later used for output, syzkaller triggering a WARN_ON_ONCE() in ip_rt_bug() as bellow:

------------[ cut here ]------------ WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20 RIP: 0010:ip_rt_bug+0x14/0x20 Call Trace: ip_push_pending_frames+0xfa/0x100 __icmp_send+0x905/0xf10 ip_options_compile+0xc0/0xd0 ip_rcv_finish_core+0x321/0xae0 ip_rcv+0x1de/0x260 __netif_receive_skb_one_core+0x11a/0x130 netif_receive_skb+0x7b/0x260 tun_get_user+0x11bf/0x1c10 ------------[ cut here ]------------

Reject input route that is RTN_UNREACHABLE to fix it. The net warning is only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of a race condition.

Affected VersionsENISA

Linux patch: 6.6.158

Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 <06083cea4a3b95f5ebc85312f97d7086e6c9e782

Linux patch: 6.1.189

Linux patch: 7.2.8

Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 <cac69c50716c712ef0114837c9427da66066124c

Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 <83aa83f81a8fec30ff5372dee60b2f0561bcb2ca

Linux patch: 6.12.112

Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 <1af2d87964d87ba7626d96928d68c09158b5a223

Linux patch: 0

Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 <2998147b59c9df0a51477c7a6b3d1f0ba3127dd4

Linux patch: 6.18.54

Linux 2.6.25

Linux 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 <fda3000147dc96c75ba162f680bec0a9fecf3037

Linux patch: 7.3-rc4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

CVE Published

Oct 06, 2026 - 08:46 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Threat Intel

1 sources

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS NEWS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.