CVE-2026-99074
Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path. For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh->nh_grp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it. A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update_or_create_fnhe+0x45/0x15b0 Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request. Replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.
How to fix
- Linux Linux82d83eec893d8ae84f280aec44c60d9fdecc62b5, a411df69524f91fe3adb8f9544d33e701fc9732c, 7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a, c60d17d6dd61adc761ac6f65a008fefbc54cbf87, c6d670ac656badfd0e15355e07a13a6bdf3b69fd, f27483f9975b5065ff67054cc7eb8edac6083488, 6619e01855e65ef35723685a557e3eb106f4ecf5, 5.15.224, 6.1.191, 6.6.160, 6.12.113 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | fc07a232326a623d0be482e307c08ea7049c2846 ≤ v < 82d83eec893d8ae84f280aec44c60d9fdecc62b5, b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e ≤ v < a411df69524f91fe3adb8f9544d33e701fc9732c, 3bed2abab4a682d426624ce9add9d7b6d475d4e4 ≤ v < 7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a, 7f5005457b3072fe1ddf15bfef869f2a1d98e05e ≤ v < c60d17d6dd61adc761ac6f65a008fefbc54cbf87, 7d3f3b4367f315a61fc615e3138f3d320da8c466 ≤ v < c6d670ac656badfd0e15355e07a13a6bdf3b69fd, 7d3f3b4367f315a61fc615e3138f3d320da8c466 ≤ v < f27483f9975b5065ff67054cc7eb8edac6083488, 7d3f3b4367f315a61fc615e3138f3d320da8c466 ≤ v < 6619e01855e65ef35723685a557e3eb106f4ecf5, 5.15.179 ≤ v < 5.15.224, 6.1.129 ≤ v < 6.1.191, 6.6.79 ≤ v < 6.6.160, 6.12.16 ≤ v < 6.12.113, 6.13 | 82d83eec893d8ae84f280aec44c60d9fdecc62b5, a411df69524f91fe3adb8f9544d33e701fc9732c, 7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a, c60d17d6dd61adc761ac6f65a008fefbc54cbf87, c6d670ac656badfd0e15355e07a13a6bdf3b69fd, f27483f9975b5065ff67054cc7eb8edac6083488, 6619e01855e65ef35723685a557e3eb106f4ecf5, 5.15.224, 6.1.191, 6.6.160, 6.12.113 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.