In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a… (CVE-2026-99041)

The vulnerability in the Linux kernel's ip6_gre module was due to the legacy PMTU update code in ip6erspan_tunnel_xmit() treating a METADATA_IP_TUNNEL destination as a route. Because this metadata destination lacks an output device, dereferencing dst_dev(dst)->mtu caused a null pointer dereference, resulting in a kernel panic. This obsolete PMTU update was removed following changes introduced in commit fe1a4ca0a2b7, which improved IPv6 GRE Too Big handling by updating the underlay route instead. The fix removes the stale ERSPAN copy and the unused destination variable, preventing the null pointer dereference and aligning ERSPAN with IPv6 GRE PMTU handling.

The vulnerability could cause a kernel panic due to a null pointer dereference when processing certain network packets involving ERSPAN tunnels, potentially leading to denial of service on affected systems.

A fix has been applied to the Linux kernel source code that removes the obsolete ERSPAN PMTU update code causing the null pointer dereference. Users should update to a Linux kernel version that includes this fix. Patch status is confirmed by the vendor advisory describing the code removal. No additional mitigation is required beyond applying the official fix.