{"id":"CVE-2026-99041","kind":"vulnerability","aliases":["CVE-2026-99041"],"related":[],"title":"Linux kernel: ERSPAN tunnel path can panic the kernel via null pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nip6_gre: remove obsolete ERSPAN PMTU update\n\nA tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb,\nand mirred can redirect it to a native ip6erspan device. The legacy PMTU\nupdate in ip6erspan_tunnel_xmit() treats that metadata dst as a route.\nSince it has no output device, dst_dev(dst)->mtu dereferences NULL.\n\nOn v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used\nself-created user and network namespaces to trigger:\n\n  KASAN: null-ptr-deref\n  RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe update is obsolete. Commit fe1a4ca0a2b7 (\"ip6_gre: process toobig\nin a better way\") changed IPv6 GRE Too Big handling to update the\nunderlay route and removed the equivalent block from __gre6_xmit().\nip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.\n\nRemove the stale ERSPAN copy and its now-unused dst variable. This\neliminates the metadata-dst dereference and keeps ERSPAN aligned with\nIPv6 GRE PMTU handling.","summary":"A tc tunnel_key action combined with mirred redirect to a native ip6erspan device makes the kernel dereference a NULL device pointer while handling path MTU updates. The reported result is a kernel panic (denial of service) triggered from an unprivileged user with self-created namespaces.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","networking","runtime","self-hosted"],"not_affected_if":["default-config","no-ip6erspan-devices"],"how_to_check":"- `uname -r` and compare against the kernel version that contains the upstream fix, which the sources do not name\n- `lsmod | grep ip6_gre` to see whether the ip6_gre/ip6erspan module is loaded at all\n- Check whether unprivileged user namespaces are allowed: `sysctl kernel.unprivileged_userns_clone` or `sysctl user.max_user_namespaces`","fix":"- Update the Linux kernel to a release that includes the upstream commit removing the obsolete ERSPAN PMTU update (the sources name the fix as removing the stale block; the exact fixed version is unknown)\n- Until patched, unload the ip6 GRE tunnel module if it is not needed: `modprobe -r ip6_gre`","status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:13+00:00","updated_at":"2026-10-25T04:54:13+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:54:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit removing the obsolete ERSPAN PMTU update (the sources name the fix as removing the stale block; the exact fixed version is unknown)\n- Until patched, unload the ip6 GRE tunnel module if it is not needed: `modprobe -r ip6_gre`","reach":"local","title":"Linux kernel: ERSPAN tunnel path can panic the kernel via null pointer","impact":"low","summary":"A tc tunnel_key action combined with mirred redirect to a native ip6erspan device makes the kernel dereference a NULL device pointer while handling path MTU updates. The reported result is a kernel panic (denial of service) triggered from an unprivileged user with self-created namespaces.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","self-hosted","networking"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel panic halts the machine, causing denial of service","analyst_note":"Find the upstream kernel commit and the first stable release containing the fix, and confirm the affected version range from the kernel.org stable advisory.","how_to_check":"- `uname -r` and compare against the kernel version that contains the upstream fix, which the sources do not name\n- `lsmod | grep ip6_gre` to see whether the ip6_gre/ip6erspan module is loaded at all\n- Check whether unprivileged user namespaces are allowed: `sysctl kernel.unprivileged_userns_clone` or `sysctl user.max_user_namespaces`","needs_analyst":true,"not_affected_if":["no-ip6erspan-devices","default-config"],"who_is_affected":"Only systems that load the IPv6 GRE/ERSPAN tunnel driver and use ERSPAN tunnel devices with tc tunnel_key and mirred redirection are exposed. Hosts that do not use ip6erspan devices can skip it, and the sources say the reproduction was on a development kernel v7.2 with KASAN.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":3711,"output_tokens":736,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':173C '-2026':14A,17A '-99041':15A,18A '0':153C '65534':149C 'action':30B,94C 'align':250C 'attach':96C 'better':195C 'big':201C 'block':212C 'capeff':152C 'chang':197C 'combin':31B 'commit':187C 'copi':232C 'creat':71B,157C 'cve':13A,16A 'denial':60B 'deref':168C 'derefer':43B,140C,246C 'dev':137C 'devic':39B,46B,114C,135C 'dst':101C,126C,136C,138C,238C,245C 'elimin':241C 'equival':211C 'erspan':3A,87C,231C,249C 'except':180C 'fatal':179C 'fe1a4ca0a2b7':188C 'follow':78C 'gre':84C,190C,199C,253C 'gre6':214C 'handl':49B,202C,255C 'host':25B 'initi':147C 'interrupt':182C 'ip':99C 'ip6':83C,189C,216C 'ip6erspan':38B,113C,120C,170C 'ipv6':198C,252C 'kasan':145C,164C 'keep':248C 'kernel':2A,9A,19B,42B,58B,76C,175C 'key':29B,93C 'legaci':116C 'linux':1A,20B,75C 'make':40B 'metadata':98C,125C,244C 'metadata-dst':243C 'mir':33B,106C 'mtu':51B,139C 'namespac':72B,161C 'nativ':37B,112C 'network':21B,160C 'now-unus':235C 'null':11A,45B,141C,166C 'null-ptr-deref':165C 'obsolet':86C,186C 'output':134C 'overlay':226C 'panic':7A,59B,176C 'path':5A,50B 'pmtu':88C,117C,223C,254C 'pointer':12A,47B 'process':150C,191C 'propag':220C 'ptr':167C 'redirect':34B,108C 'remov':85C,209C,228C 'report':54B 'resolv':82C 'result':55B 'rip':169C 'rout':129C,207C,227C 'runtim':22B 'self':24B,70B,156C 'self-creat':69B,155C 'self-host':23B 'servic':62B 'sinc':130C 'skb':104C 'stale':230C 'sync':178C 'tc':27B,91C 'tnl':217C 'toobig':192C 'treat':123C 'trigger':63B,163C 'tunnel':4A,28B,92C,100C,121C,171C 'uid/gid':148C 'underlay':206C,222C 'unprivileg':66B 'unus':237C 'updat':52B,89C,118C,184C,204C 'use':154C 'user':67B,158C 'v7.2':143C 'variabl':239C 'via':10A 'vulner':79C 'way':196C 'x10fc/0x2cc0':174C 'xmit':122C,172C,215C,218C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load the IPv6 GRE/ERSPAN tunnel driver and use ERSPAN tunnel devices with tc tunnel_key and mirred redirection are exposed. Hosts that do not use ip6erspan devices can skip it, and the sources say the reproduction was on a development kernel v7.2 with KASAN.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99041","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}