In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4:… (CVE-2026-99074)

The vulnerability in the Linux kernel's IPv4 implementation relates to the Path MTU (PMTU) discovery process when multipath routing is enabled. A commit that updated PMTU for all packet paths introduced a race condition where the nexthop group could shrink after an index was accepted but before it was dereferenced, leading to a null pointer dereference in update_or_create_fnhe(). This occurs because fib_info_nhc() may return NULL if the nexthop group shrinks, but the code does not check for this before dereferencing. The issue can cause a kernel oops (crash). Exploitation requires CAP_NET_ADMIN privileges in the network namespace, which can be gained by a local user if unprivileged user namespaces are enabled.

The vulnerability can cause a kernel null pointer dereference resulting in a kernel crash (oops). This impacts system stability and could potentially be leveraged for denial of service by local users with CAP_NET_ADMIN capability. Since CAP_NET_ADMIN is required and can be obtained in certain configurations, the vulnerability poses a local privilege escalation risk in environments allowing unprivileged user namespaces.

A fix has been implemented in the Linux kernel to stop the PMTU walk when the indexed nexthop path is absent, preventing the null pointer dereference. Users should apply the official kernel update containing commit 7d3f3b4367f3 or later. If unprivileged user namespaces are enabled, consider restricting their use to reduce risk. Patch status is not explicitly confirmed in the input; users should consult the Linux kernel vendor advisory for the exact fixed versions and apply updates accordingly.