CVE-2026-99041: Linux kernel · ip6_gre: remove obsolete ERSPAN PMTU update
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 28 Oct 2026, 01:44 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.10linuxpkg:deb/ubuntu/linux?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-oraclepkg:deb/ubuntu/linux-oracle?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available that removes the obsolete ERSPAN PMTU update code from the Linux kernel ip6_gre module. Users should update to patched kernel versions that include this fix. No additional mitigation actions are required beyond applying the official kernel update.
Description
A vulnerability in the Linux kernel's ip6_gre module related to obsolete ERSPAN Path MTU (PMTU) update handling has been resolved. The legacy PMTU update code in ip6erspan_tunnel_xmit() incorrectly dereferences a null pointer due to treating a metadata destination as a route without an output device, causing a kernel panic. This issue was triggered by specific user and network namespace configurations. The obsolete code was removed to align ERSPAN PMTU handling with IPv6 GRE, eliminating the null pointer dereference and preventing kernel crashes.
References
- ubuntu.com/security/CVE-2026-99041 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-99041 (opens in a new tab)
- git.kernel.org/stable/c/2d06cb25a497d3a7034ef9d172626c2d6620a0f1 (opens in a new tab)
- git.kernel.org/stable/c/8bc60db48e8cba35488bbd6e1f94aa990afa275a (opens in a new tab)
- git.kernel.org/stable/c/8f27260b989f488760289276377db24fbfb20bfa (opens in a new tab)
- git.kernel.org/stable/c/b14a682ad7d45345701e08f9279d483a1da8b36c (opens in a new tab)
- git.kernel.org/stable/c/f5b143f4cd3fb7673df8d727550478a4b762908a (opens in a new tab)