CVE-2026-99074 ipv4: stop PMTU walk when nexthop group shrinks
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99074?
CVE-2026-99074 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop PMTU walk when nexthop group shrinks
Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path.
For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh->nh_grp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it.
A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update_or_create_fnhe+0x45/0x15b0
Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request.
Replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.
Which versions are affected by CVE-2026-99074?
How do I fix CVE-2026-99074?
Upgrade to a fixed version.
Is CVE-2026-99074 being exploited?
There is no known exploitation of CVE-2026-99074 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99074, DEBIAN-CVE-2026-99074, GHSA-j9w6-p85x-r6r9, UBUNTU-CVE-2026-99074.