Live › vulnerability › CVE-2026-99074
Go to dashboardWhen a nexthop group shrinks during a path MTU update, the IPv4 code can dereference a null pointer and crash the kernel. The sources describe a local crash and do not state an attacker code execution path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with nexthop objects and multipath IPv4 routing, where a process with CAP_NET_ADMIN replaces nexthop groups while PMTU updates occur. Local users can reach the required privilege only where unprivileged user namespaces are permitted. Hosts without multipath nexthop groups or with unprivileged user namespaces disabled are less exposed.
No product ranges from the sources yet.
uname -r to see the running kernel versionsysctl kernel.unprivileged_userns_clone or sysctl user.max_user_namespacesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop PMTU walk when nexthop group shrinks
Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path.
For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh->nh_grp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it.
A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update_or_create_fnhe+0x45/0x15b0
Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request.
Replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.
This page as .md · .json · in your agent: get_signal("CVE-2026-99074")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.