CVE-2026-98303

A flaw in the Linux kernel's IPv4 ICMP error-message routing is rated Moderate by Red Hat Product Security and affects the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels (including kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS layers of OpenShift Container Platform 4 and 5. When the kernel generates an ICMP error response and the forward output route cannot be used, icmp_route_lookup() falls back to a reverse-path lookup that calls ip_route_input() on the original packet's source address. For unreachable source addresses, this lookup can succeed and return an RTN_UNREACHABLE input route whose output callback is ip_rt_bug(); because the existing check only rejected RTN_LOCAL routes, the invalid route can be used for output, triggering a WARN_ON_ONCE() in ip_rt_bug() and dropping the outgoing ICMP response. An attacker who can transmit crafted IPv4 packets that cause the kernel to generate ICMP error replies toward unreachable destinations can trigger this condition and cause a denial of service: under default configurations the effect is a kernel warning and a dropped packet, while systems configured with panic_on_warn can panic. Red Hat Enterprise Linux 6 is out of support (OOSS) and will not receive a fix. For all affected streams the fix is deferred to a future update; the residual risk is limited to availability, with no impact on confidentiality or integrity. The Red Hat severity (Moderate, CVSS 3.1 score 5.5, local attack vector) reflects that the publicly demonstrated reproducer requires local privileges to set up the triggering configuration, although a remotely transmitted trigger remains plausible.