CVE intelligence

CVE-2026-99121

Vulnerability intelligence

Published Oct 28, 2026Sources checked Oct 28, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-99121. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Oct 29, 2026

Release Notes

CISA KEVNot listedBased on the latest collected catalog

EPSSUnavailableNo current score collected

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-99121?

In the Linux kernel, the following vulnerability has been resolved:

ipv4: avoid divide by zero in fib_rebalance

fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_routes_with_linkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero.

If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6_multipath_rebalance") and preserves the lock-free rebalance path.

Source: NVD