CVE-2026-99074
Received
Received - Intake
Linux Kernel IPv4 PMTU Walk Null Pointer Dereference
Vulnerability report for CVE-2026-99074, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop PMTU walk when nexthop group shrinks
Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if
multipath enabled") made __ip_rt_update_pmtu() update every path.
For nexthop objects, fib_info_num_path() and fib_info_nhc()
independently load nh->nh_grp. RCU protects each group's lifetime but
does not make the loads observe the same group. If replacement shrinks
the group after the loop accepts an index, fib_info_nhc() returns NULL
and update_or_create_fnhe() dereferences it.
A deterministic probe only widened the existing window between the real
operations. On v7.2, an RTM_NEWNEXTHOP replacement published a
one-member group after the PMTU reader accepted index 1 from a two-member
group, producing:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: update_or_create_fnhe+0x45/0x15b0
Stop when the indexed path is absent. Groups are dense, so no later
index exists in that snapshot. The same real-writer window completed
114,423 PMTU iterations without an oops with this check. A reproducer
is available on request.
Replacement requires CAP_NET_ADMIN in the network namespace. Where
unprivileged user namespaces are permitted, a local user can obtain it
in a new user and network namespace.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 3bed2abab4a682d426624ce9add9d7b6d475d4e4 |
| Linux | Linux | 7f5005457b3072fe1ddf15bfef869f2a1d98e05e |
| Linux | Linux | 7d3f3b4367f315a61fc615e3138f3d320da8c466 |
| Linux | Linux | 7d3f3b4367f315a61fc615e3138f3d320da8c466 |
| Linux | Linux | 7d3f3b4367f315a61fc615e3138f3d320da8c466 |
| Linux | Linux | fc07a232326a623d0be482e307c08ea7049c2846 |
| Linux | Linux | b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e |
| Linux | Linux | 6.6.79 |
| Linux | Linux | 6.12.16 |
| Linux | Linux | 5.15.179 |
| Linux | Linux | 6.1.129 |
| Linux | Linux | 6.13 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
