{"id":"CVE-2026-99074","kind":"vulnerability","aliases":["CVE-2026-99074"],"related":[],"title":"Linux kernel: IPv4 PMTU update can dereference a null nexthop pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh->nh_grp.  RCU protects each group's lifetime but\ndoes not make the loads observe the same group.  If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\noperations.  On v7.2, an RTM_NEWNEXTHOP replacement published a\none-member group after the PMTU reader accepted index 1 from a two-member\ngroup, producing:\n\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: update_or_create_fnhe+0x45/0x15b0\n\nStop when the indexed path is absent.  Groups are dense, so no later\nindex exists in that snapshot.  The same real-writer window completed\n114,423 PMTU iterations without an oops with this check.  A reproducer\nis available on request.\n\nReplacement requires CAP_NET_ADMIN in the network namespace.  Where\nunprivileged user namespaces are permitted, a local user can obtain it\nin a new user and network namespace.","summary":"When a nexthop group shrinks during a path MTU update, the IPv4 code can dereference a null pointer and crash the kernel. The sources describe a local crash and do not state an attacker code execution path.","severity":"unknown","cvss":null,"epss":0.00199,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipv4","kernel","linux","multi-tenant-hosts","routing"],"not_affected_if":["no-nexthop-groups","unprivileged-userns-disabled"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether unprivileged user namespaces are enabled: `sysctl kernel.unprivileged_userns_clone` or `sysctl user.max_user_namespaces`\n- Check your distribution's kernel advisory for whether the fixed kernel is installed","fix":"- Update the Linux kernel to a release that includes the upstream fix (the 'stop PMTU walk when nexthop group shrinks' change); the fixed version is unknown from these sources\n- Until patched, consider disabling unprivileged user namespaces if your workloads allow it","status":"open","published_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:44+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:53:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix (the 'stop PMTU walk when nexthop group shrinks' change); the fixed version is unknown from these sources\n- Until patched, consider disabling unprivileged user namespaces if your workloads allow it","reach":"local","title":"Linux kernel: IPv4 PMTU update can dereference a null nexthop pointer","impact":"medium","summary":"When a nexthop group shrinks during a path MTU update, the IPv4 code can dereference a null pointer and crash the kernel. The sources describe a local crash and do not state an attacker code execution path.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","ipv4","routing","multi-tenant-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user triggers kernel null pointer dereference and crash","analyst_note":"Find the upstream fixed kernel versions and the affected stable branch ranges from the NVD entry or kernel.org stable commits.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether unprivileged user namespaces are enabled: `sysctl kernel.unprivileged_userns_clone` or `sysctl user.max_user_namespaces`\n- Check your distribution's kernel advisory for whether the fixed kernel is installed","needs_analyst":true,"not_affected_if":["unprivileged-userns-disabled","no-nexthop-groups"],"who_is_affected":"Systems running a Linux kernel with nexthop objects and multipath IPv4 routing, where a process with CAP_NET_ADMIN replaces nexthop groups while PMTU updates occur. Local users can reach the required privilege only where unprivileged user namespaces are permitted. Hosts without multipath nexthop groups or with unprivileged user namespaces disabled are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000719,"input_tokens":3737,"output_tokens":690,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':211C '-2026':13A,16A '-99074':14A,17A '0x0000000000000000':204C '0x0000000000000000-0x0000000000000007':203C '0x0000000000000007':205C '1':188C '114':238C '423':239C '7d3f3b4367f3':83C 'absent':219C 'accept':143C,186C 'admin':258C 'attack':60B 'avail':251C 'cach':86C 'cap':256C 'check':247C 'code':39B,61B 'commit':82C 'complet':237C 'crash':46B,54B 'creat':154C,209C 'cve':12A,15A 'dens':222C 'deref':200C 'derefer':7A,41B,156C 'describ':51B 'determinist':159C 'enabl':94C 'everi':101C 'execut':62B 'exist':164C,227C 'fib':106C,111C,146C 'fnhe':155C,210C 'follow':69C 'group':30B,80C,122C,134C,139C,181C,194C,220C 'grp':118C 'host':25B 'independ':114C 'index':145C,187C,216C,226C 'info':107C,112C,147C 'infrastructur':18B 'ip':96C 'ipv4':3A,19B,38B,74C,85C 'iter':241C 'kasan':196C 'kernel':2A,20B,48B,67C 'later':225C 'lifetim':124C 'linux':1A,21B,66C 'load':115C,130C 'local':53B,270C 'loop':142C 'made':95C 'make':128C 'member':180C,193C 'mtu':35B 'multi':23B 'multi-tenant-host':22B 'multipath':93C 'namespac':262C,266C,281C 'net':84C,257C 'network':261C,280C 'new':277C 'newnexthop':174C 'nexthop':10A,29B,79C,104C 'nh':116C,117C 'nhc':113C,148C 'null':9A,43B,150C,198C 'null-ptr-deref':197C 'num':108C 'object':105C 'observ':131C 'obtain':273C 'one':179C 'one-memb':178C 'oop':244C 'oper':169C 'packet':90C 'path':34B,63B,91C,102C,109C,217C 'permit':268C 'pmtu':4A,76C,87C,99C,184C,240C 'pointer':11A,44B 'probe':160C 'produc':195C 'protect':120C 'ptr':199C 'publish':176C 'rang':202C 'rcu':119C 'reader':185C 'real':168C,234C 'real-writ':233C 'replac':136C,175C,254C 'reproduc':249C 'request':253C 'requir':255C 'resolv':73C 'return':149C 'rip':206C 'rout':26B 'rt':97C 'rtm':173C 'shrink':31B,81C,137C 'snapshot':230C 'sourc':50B 'state':58B 'stop':75C,213C 'tenant':24B 'two':192C 'two-memb':191C 'unprivileg':264C 'updat':5A,36B,98C,100C,152C,207C 'user':265C,271C,278C 'v7.2':171C 'vulner':70C 'walk':77C 'widen':162C 'window':165C,236C 'without':242C 'writer':235C 'x45/0x15b0':212C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with nexthop objects and multipath IPv4 routing, where a process with CAP_NET_ADMIN replaces nexthop groups while PMTU updates occur. Local users can reach the required privilege only where unprivileged user namespaces are permitted. Hosts without multipath nexthop groups or with unprivileged user namespaces disabled are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99074","severity":null,"published_at":"2026-10-23T13:17:31+00:00","modified_at":"2026-10-23T13:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99074","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99074","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}