Cloudanix VulnDB

CVE-2026-99041

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug in handling certain IPv6 network tunnels can make the whole system crash when specific network rules are active.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in ip6erspan_tunnel_xmit when a metadata dst from tc tunnel_key is treated as a route, dereferencing dst_dev(dst) which lacks an output device and triggering KASAN null-ptr-deref followed by kernel panic.

Why it matters to the business

Systems using IPv6 ERSPAN tunnels with tc actions can experience unexpected kernel crashes and reboots, disrupting network traffic and requiring manual intervention; low exploitability and recent publication reduce immediate widespread risk.

How an attack unfolds

An attacker with ability to create user and network namespaces configures a tc tunnel_key action attaching METADATA_IP_TUNNEL dst, redirects via mirred to an ip6erspan device, and triggers the legacy PMTU update path that assumes a valid route, causing the dereference.

How to fix it

Update to a Linux kernel containing commit removing the obsolete ERSPAN PMTU update block from ip6erspan_tunnel_xmit and its unused dst variable, aligning ERSPAN with current IPv6 GRE handling.

How to confirm the fix worked

Verify kernel source no longer contains the legacy PMTU update code path in ip6erspan_tunnel_xmit; confirm absence of the dst_dev(dst) dereference pattern and test namespace-based traffic redirection does not panic.

Typical attack path

  1. Obtain unprivileged access allowing user/network namespace creation
  2. Set up tc rules attaching METADATA_IP_TUNNEL dst to skb
  3. Redirect traffic via mirred to native ip6erspan device
  4. Invoke ip6erspan_tunnel_xmit triggering obsolete PMTU block
  5. Cause null dereference and kernel panic

How to detect it

Search kernel logs for KASAN null-ptr-deref reports citing ip6erspan_tunnel_xmit, fatal exceptions in interrupt context, or panics referencing ERSPAN PMTU handling; correlate with recent tc rule changes or namespace creation events.

  • KASAN: null-ptr-deref
  • RIP: ip6erspan_tunnel_xmit
  • Kernel panic - not syncing: Fatal exception in interrupt
  • ip6_gre: remove obsolete ERSPAN PMTU update

What your security team should do

  • Monitor upstream kernel patches for ip6_gre and schedule updates within normal maintenance windows given low EPSS and non-KEV status
  • Audit environments for use of ip6erspan combined with tc tunnel_key actions
  • Enable KASAN or similar debugging on test systems to validate exposure
  • Review network namespace and tc policy controls to limit untrusted trigger paths

The record

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan_tunnel_xmit() treats that metadata dst as a route. Since it has no output device, dst_dev(dst)->mtu dereferences NULL. On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used self-created user and network namespaces to trigger: KASAN: null-ptr-deref RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0 Kernel panic - not syncing: Fatal exception in interrupt The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig in a better way") changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from __gre6_xmit(). ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route. Remove the stale ERSPAN copy and its now-unused dst variable. This eliminates the metadata-dst dereference and keeps ERSPAN aligned with IPv6 GRE PMTU handling.

Affected packages

Ecosystem Package Introduced Fixed