Cloudanix VulnDB

CVE-2026-99074

None

CVSS

—

EPSS

0.1%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's network routing code can cause the whole system to crash when network paths are updated under certain multipath configurations.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in __ip_rt_update_pmtu allows fib_info_nhc to return NULL when a nexthop group shrinks during PMTU walk, causing null pointer dereference in update_or_create_fnhe.

Why it matters to the business

Kernel crashes on systems using IPv4 multipath routing can lead to unexpected reboots, service outages, and loss of network connectivity, with higher urgency on recently published flaws still lacking widespread backports.

How an attack unfolds

An attacker with CAP_NET_ADMIN in a network namespace (obtainable via unprivileged user namespaces) issues RTM_NEWNEXTHOP replacements to shrink a nexthop group while concurrently triggering PMTU updates, hitting the window where an index from the old group is dereferenced against the new smaller group.

How to fix it

Apply the upstream fix that adds a check to stop the PMTU walk when the indexed path is absent; rebuild and deploy patched kernels across all affected distributions.

How to confirm the fix worked

Verify the presence of the check that aborts when fib_info_nhc returns NULL inside the PMTU update loop; confirm no KASAN reports occur under the original reproducer conditions.

Typical attack path

  1. Obtain CAP_NET_ADMIN in a suitable network namespace
  2. Create a multipath nexthop group with multiple members
  3. Trigger concurrent PMTU discovery or route updates
  4. Replace the nexthop group with a smaller one via netlink
  5. Cause update_or_create_fnhe to dereference a stale index resulting in null dereference

How to detect it

Search kernel logs and dmesg for KASAN null-ptr-deref reports mentioning update_or_create_fnhe or fib_info_nhc during netlink nexthop operations; review audit logs for unexpected RTM_NEWNEXTHOP messages from unprivileged namespaces.

  • KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  • RIP: update_or_create_fnhe
  • fib_info_nhc

What your security team should do

  • Prioritize kernel updates on all systems exposing multipath IPv4 routing within the next 30 days
  • Disable unprivileged user namespaces where not required to reduce attack surface
  • Monitor for kernel oops involving PMTU and nexthop handling

The record

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path. For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh->nh_grp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it. A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update_or_create_fnhe+0x45/0x15b0 Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request. Replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.

Affected packages

Ecosystem Package Introduced Fixed