{"id":"CVE-2026-99074","revision":"4f9c1a84eb9944e580818ff6d7ae81b9","records":[{"revision":"4f9c1a84eb9944e580818ff6d7ae81b9","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-99074","aliases":[],"title":"ipv4: stop PMTU walk when nexthop group shrinks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh->nh_grp.  RCU protects each group's lifetime but\ndoes not make the loads observe the same group.  If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\noperations.  On v7.2, an RTM_NEWNEXTHOP replacement published a\none-member group after the PMTU reader accepted index 1 from a two-member\ngroup, producing:\n\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: update_or_create_fnhe+0x45/0x15b0\n\nStop when the indexed path is absent.  Groups are dense, so no later\nindex exists in that snapshot.  The same real-writer window completed\n114,423 PMTU iterations without an oops with this check.  A reproducer\nis available on request.\n\nReplacement requires CAP_NET_ADMIN in the network namespace.  Where\nunprivileged user namespaces are permitted, a local user can obtain it\nin a new user and network namespace.","state":0,"publishedAt":"2026-10-23T12:23:17.866+00:00","modifiedAt":"2026-10-23T12:23:17.866+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/route.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3bed2abab4a682d426624ce9add9d7b6d475d4e4\",\n                            \"lessThan\": \"7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7f5005457b3072fe1ddf15bfef869f2a1d98e05e\",\n                            \"lessThan\": \"c60d17d6dd61adc761ac6f65a008fefbc54cbf87\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7d3f3b4367f315a61fc615e3138f3d320da8c466\",\n                            \"lessThan\": \"c6d670ac656badfd0e15355e07a13a6bdf3b69fd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7d3f3b4367f315a61fc615e3138f3d320da8c466\",\n                            \"lessThan\": \"f27483f9975b5065ff67054cc7eb8edac6083488\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7d3f3b4367f315a61fc615e3138f3d320da8c466\",\n                            \"lessThan\": \"6619e01855e65ef35723685a557e3eb106f4ecf5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fc07a232326a623d0be482e307c08ea7049c2846\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.79\",\n                            \"lessThan\": \"6.6.160\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.16\",\n                            \"lessThan\": \"6.12.113\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.179\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.129\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/route.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.11\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a","https://git.kernel.org/stable/c/c60d17d6dd61adc761ac6f65a008fefbc54cbf87","https://git.kernel.org/stable/c/c6d670ac656badfd0e15355e07a13a6bdf3b69fd","https://git.kernel.org/stable/c/f27483f9975b5065ff67054cc7eb8edac6083488","https://git.kernel.org/stable/c/6619e01855e65ef35723685a557e3eb106f4ecf5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99074","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99074","identifiers":["CVE-2026-99074"]},"retained":false,"historicalAffected":[]}],"coverage":[]}