CVE-2026-98031

A MODERATE severity flaw was found in the Linux kernel nexthop routing subsystem. When a nexthop group entry is removed, the error path in remove_nh_grp_entry() prints an extended acknowledgment (extack) message, but the extack structure is not initialized there, and nexthop listeners are not required to set an error message when they fail to replace a reduced nexthop group. Listeners such as netdevsim and mlxsw do not set a message when an allocation fails, so the kernel can dereference an uninitialized stack pointer and crash, resulting in a local denial of service. Exploitation requires local access with network administration privileges (CAP_NET_ADMIN) to manipulate nexthop objects, and triggering also depends on a listener failing an allocation or replacement, which limits practical exploitability. Red Hat Enterprise Linux 9 and 10, the Real Time kernel on affected Red Hat Enterprise Linux 9 streams, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping RHEL CoreOS 9 kernels are affected. Red Hat Enterprise Linux 6, 7, and 8 (including kernel-rt), and OpenShift Container Platform releases shipping RHEL CoreOS 8 are not affected because the vulnerable code is not present in those kernels. Because this issue can only be triggered locally by a privileged user under unlikely error-path conditions and its impact is limited to denial of service, the fix is currently deferred for the affected releases; the residual risk is that a local attacker with network administration privileges could crash an affected system.