---
id: "CVE-2026-99041"
kind: "vulnerability"
aliases: ["CVE-2026-99041"]
title: "Linux kernel: ERSPAN tunnel path can panic the kernel via null pointer"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kernel", "linux", "networking", "runtime", "self-hosted"]
not_affected_if: ["default-config", "no-ip6erspan-devices"]
published_at: "2026-10-23T13:17:27+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99041", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99041", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: ERSPAN tunnel path can panic the kernel via null pointer

A tc tunnel_key action combined with mirred redirect to a native ip6erspan device makes the kernel dereference a NULL device pointer while handling path MTU updates. The reported result is a kernel panic (denial of service) triggered from an unprivileged user with self-created namespaces.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the kernel version that contains the upstream fix, which the sources do not name
- `lsmod | grep ip6_gre` to see whether the ip6_gre/ip6erspan module is loaded at all
- Check whether unprivileged user namespaces are allowed: `sysctl kernel.unprivileged_userns_clone` or `sysctl user.max_user_namespaces`

## Fix

- Update the Linux kernel to a release that includes the upstream commit removing the obsolete ERSPAN PMTU update (the sources name the fix as removing the stale block; the exact fixed version is unknown)
- Until patched, unload the ip6 GRE tunnel module if it is not needed: `modprobe -r ip6_gre`

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99041
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99041

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: remove obsolete ERSPAN PMTU update

A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb,
and mirred can redirect it to a native ip6erspan device. The legacy PMTU
update in ip6erspan_tunnel_xmit() treats that metadata dst as a route.
Since it has no output device, dst_dev(dst)->mtu dereferences NULL.

On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used
self-created user and network namespaces to trigger:

  KASAN: null-ptr-deref
  RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0
  Kernel panic - not syncing: Fatal exception in interrupt

The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig
in a better way") changed IPv6 GRE Too Big handling to update the
underlay route and removed the equivalent block from __gre6_xmit().
ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.

Remove the stale ERSPAN copy and its now-unused dst variable. This
eliminates the metadata-dst dereference and keeps ERSPAN aligned with
IPv6 GRE PMTU handling.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_