VulnerabilityPublished 26 Oct 2026Updated 27 Oct 2026

CVE-2026-99074: Linux kernel · ipv4: stop PMTU walk when nexthop group shrinks

Affects Linux kernelSource GCVE Database

Authoritative record:CVE-2026-99074· High

Not known to be exploited.

Data as of 28 Oct 2026, 01:31 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Ubuntu 26.10linux`pkg:deb/ubuntu/linux?arch=source&distro=stonking`Other threats	Affected 7.0.0-14.14 – 7.3.0-9.9 6 affected builds	Fixed in–
Ubuntu 26.10linux-aws`pkg:deb/ubuntu/linux-aws?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1003.3 5 affected builds	Fixed in–
Ubuntu 26.10linux-azure`pkg:deb/ubuntu/linux-azure?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1003.3 5 affected builds	Fixed in–
Ubuntu 26.10linux-azure-fde`pkg:deb/ubuntu/linux-azure-fde?arch=source&distro=stonking`Other threats	Affected =7.0.0-1004.4 =7.3.0-1002.3 =7.3.0-1003.4	Fixed in–
Ubuntu 26.10linux-gcp`pkg:deb/ubuntu/linux-gcp?arch=source&distro=stonking`Other threats	Affected 7.0.0-1003.3 – 7.3.0-1003.3 5 affected builds	Fixed in–
Ubuntu 26.10linux-oracle`pkg:deb/ubuntu/linux-oracle?arch=source&distro=stonking`Other threats	Affected 7.0.0-1003.3 – 7.3.0-1003.3 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available as the vulnerability has been resolved in the Linux kernel. Users should apply the updated kernel versions that include the patch. Since exploitation requires CAP_NET_ADMIN in a network namespace, restricting the creation of unprivileged user namespaces can reduce risk. No additional mitigation steps are indicated beyond applying the official fix.

Description

A vulnerability in the Linux kernel's IPv4 implementation allows a null pointer dereference during Path MTU (PMTU) updates when a nexthop group shrinks. This occurs because the code does not properly handle cases where the nexthop group size changes concurrently, leading to a kernel crash (KASAN null pointer dereference). The issue requires CAP_NET_ADMIN privileges in the network namespace, but can be exploited by local users in unprivileged user namespaces.

Impact

The vulnerability causes a kernel crash due to a null pointer dereference, leading to denial of service. Local users with the ability to create new user and network namespaces can exploit this to gain CAP_NET_ADMIN privileges within those namespaces, potentially escalating their privileges locally. There is no indication of remote exploitation or data corruption beyond denial of service.

Summary

The Linux kernel vulnerability CVE-2026-99074 involves improper handling of nexthop groups during PMTU updates in the IPv4 stack. A commit that updated PMTU caching for multipath enabled scenarios caused __ip_rt_update_pmtu() to update every path, but the concurrent shrinking of nexthop groups can cause fib_info_nhc() to return NULL. This NULL pointer is then dereferenced in update_or_create_fnhe(), resulting in a kernel oops. The flaw is triggered when a nexthop group shrinks after an index is accepted but before the update completes. Exploitation requires CAP_NET_ADMIN in the network namespace, but local users can gain this capability in new user and network namespaces if unprivileged user namespaces are allowed. A reproducer exists, and the issue affects multiple Linux kernel versions including various Ubuntu kernel builds.

GCVE source: db.gcve.eu
OSV ID: UBUNTU-CVE-2026-99074
Osv Schema Version: 1.7.0
Ecosystems: Ubuntu:16.04:LTS, Ubuntu:18.04:LTS, Ubuntu:20.04:LTS, Ubuntu:Pro:20.04:LTS, Ubuntu:22.04:LTS, Ubuntu:Nvidia-BlueField:22.04:LTS, Ubuntu:Pro:Realtime:22.04:LTS, Ubuntu:Pro:FIPS-updates:22.04:LTS, Ubuntu:24.04:LTS, Ubuntu:Nvidia-BlueField:24.04:LTS, Ubuntu:Pro:Realtime:24.04:LTS, Ubuntu:Pro:FIPS-updates:24.04:LTS, Ubuntu:26.10, Ubuntu:26.04:LTS

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 Oct 2026, 01:31 UTC

Technical details

References

Community reviews

Related threats