CVE-2026-45847

MediumCVSS 5.5/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: remove WARN_ON_ONCE when accessing forward path array

Although unlikely, recent support for IPIP tunnels increases chances of reaching this WARN_ON_ONCE if userspace manages to build a sufficiently long forward path.

Remove it.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

VendorProductVersions
LinuxLinux>= ddb94eafab8b597b05904c8277194ea2d6357fa9, < 548244c2f542aa0ad49453e9306e715a3877bc44; >= ddb94eafab8b597b05904c8277194ea2d6357fa9, < dcf9b3c90e5560339649d088836529883fb509f3; >= ddb94eafab8b597b05904c8277194ea2d6357fa9, < 9464ca7a6e56ad1ebf48b2ad5c16871edfad10c6; >= ddb94eafab8b597b05904c8277194ea2d6357fa9, < 959ea349c7e2d4edf07b6838ca7e59345fe61a08; >= ddb94eafab8b597b05904c8277194ea2d6357fa9, < 50422613185d505201167e8bdd2f2700790d5db6; >= ddb94eafab8b597b05904c8277194ea2d6357fa9, < a78d055ba7c31103ad02f8eceb0c452e154d2660; >= ddb94eafab8b597b05904c8277194ea2d6357fa9, < 008e7a7c293b30bc43e4368dac6ea3808b75a572
LinuxLinux5.13

References

Timeline

Published
May 27, 2026
Last modified
Nov 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-458485.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL sock in aa_sock_file_perm Deal with the potential tCVE-2026-458495.5In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj(CVE-2026-45859.8A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the fCVE-2026-458505.5In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks Protocol checksum vaCVE-2026-458517.1In the Linux kernel, the following vulnerability has been resolved: efi: Fix reservation of unaccepted memory table The reserve_unacceptedCVE-2026-458527.8In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(),CVE-2026-458537.8In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memrangesCVE-2026-458545.5In the Linux kernel, the following vulnerability has been resolved: crypto: inside-secure/eip93 - unregister only available algorithm EIP9CVE-2026-458555.5In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: avoid Non-NCQ command starvation When a non-NCQ commCVE-2026-458567.1In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send CVE-2026-458575.5In the Linux kernel, the following vulnerability has been resolved: scsi: csiostor: Fix dereference of null pointer rn The error exit pathCVE-2026-458585.5In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 Whe
CVE-2026-45847: Medium severity, CVSS 5.5 | Vulnix