CVE-2026-99041 - Vulnerability Details

- ip6_gre: remove obsolete ERSPAN PMTU update

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: remove obsolete ERSPAN PMTU update

A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb,
and mirred can redirect it to a native ip6erspan device. The legacy PMTU
update in ip6erspan_tunnel_xmit() treats that metadata dst as a route.
Since it has no output device, dst_dev(dst)->mtu dereferences NULL.

On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used
self-created user and network namespaces to trigger:

KASAN: null-ptr-deref
RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0
Kernel panic - not syncing: Fatal exception in interrupt

The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig
in a better way") changed IPv6 GRE Too Big handling to update the
underlay route and removed the equivalent block from __gre6_xmit().
ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.

Remove the stale ERSPAN copy and its now-unused dst variable. This
eliminates the metadata-dst dereference and keeps ERSPAN aligned with
IPv6 GRE PMTU handling.

Published: 2026-10-23

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a null‑pointer dereference in the ip6erspan_tunnel_xmit function. A tc tunnel_key action can attach a METADATA_IP_TUNNEL destination to a packet buffer, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update treats that metadata destination as a route, but the destination has no output device, causing a dereference of dst_dev(dst)->mtu to NULL. When triggered, the kernel panics and the system reboots, destroying availability without exposing data.

Affected Systems

The vulnerability exists in all Linux kernel builds that have not applied the patch that removed the stale ERSPAN PMTU update. That patch is identified by commit fe1a4ca0a2b7, which was merged into the mainline kernel sometime after v7.2. Any kernel version before this commit, regardless of distribution or patch level, is potentially vulnerable.

Risk and Exploitability

An attacker with local access can create the necessary tc tunnel_key rule and mirred entry to trigger the fault, so the attack vector is local. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity, meaning a single exploit can cause a kernel panic and a local denial of service, rendering the host unusable. No other conditions are required for exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5a963eb61b7c39e6c422b6e48619d19d04719358`	affected	< 2e151c74bcc53e3ed313bd1c21b0d5bb442edbc0
`5a963eb61b7c39e6c422b6e48619d19d04719358`	affected	< ba72ed1c8476ce68eb7152dfcbc5330cefcbaa91
`5a963eb61b7c39e6c422b6e48619d19d04719358`	affected	< b14a682ad7d45345701e08f9279d483a1da8b36c
`5a963eb61b7c39e6c422b6e48619d19d04719358`	affected	< f5b143f4cd3fb7673df8d727550478a4b762908a
`5a963eb61b7c39e6c422b6e48619d19d04719358`	affected	< 2d06cb25a497d3a7034ef9d172626c2d6620a0f1
`5a963eb61b7c39e6c422b6e48619d19d04719358`	affected	< 8f27260b989f488760289276377db24fbfb20bfa
`5a963eb61b7c39e6c422b6e48619d19d04719358`	affected	< 8bc60db48e8cba35488bbd6e1f94aa990afa275a

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.58`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[5a963eb61b7c39e6c422b6e48619d19d04719358,b14a682ad7d45345701e08f9279d483a1da8b36c)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,f5b143f4cd3fb7673df8d727550478a4b762908a)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,2d06cb25a497d3a7034ef9d172626c2d6620a0f1)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,8f27260b989f488760289276377db24fbfb20bfa)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,8bc60db48e8cba35488bbd6e1f94aa990afa275a)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	semver	—
`[6.6.160,7.0.0)`	unaffected	semver	—
`[6.12.114,13.0.0)`	unaffected	semver	—
`[6.18.58,7.0.0)`	unaffected	semver	—
`[7.2.11,8.0.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5a963eb61b7c39e6c422b6e48619d19d04719358,b14a682ad7d45345701e08f9279d483a1da8b36c)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,f5b143f4cd3fb7673df8d727550478a4b762908a)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,2d06cb25a497d3a7034ef9d172626c2d6620a0f1)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,8f27260b989f488760289276377db24fbfb20bfa)`	affected	code_commit	—
`[5a963eb61b7c39e6c422b6e48619d19d04719358,8bc60db48e8cba35488bbd6e1f94aa990afa275a)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	semver	—
`[6.6.160,7.0.0)`	unaffected	semver	—
`[6.12.114,13.0.0)`	unaffected	semver	—
`[6.18.58,7.0.0)`	unaffected	semver	—
`[7.2.11,8.0.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit fe1a4ca0a2b7 or later
If updating the kernel is not immediately possible, rebuild the kernel from source and apply the commit manually to patch the vulnerability
Before rebooting, remove or disable any ip6erspan virtual tunnel interfaces and delete tc tunnel_key or mirred rules that redirect packets to an ip6erspan device to avoid triggering the fault

Generated by OpenCVE AI on October 29, 2026 at 14:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99041.mbox
https://git.kernel.org/stable/c/2d06cb25a497d3a7034ef9d172626c2d6620a0f1
https://git.kernel.org/stable/c/2e151c74bcc53e3ed313bd1c21b0d5bb442edbc0
https://git.kernel.org/stable/c/8bc60db48e8cba35488bbd6e1f94aa990afa275a
https://git.kernel.org/stable/c/8f27260b989f488760289276377db24fbfb20bfa
https://git.kernel.org/stable/c/b14a682ad7d45345701e08f9279d483a1da8b36c
https://git.kernel.org/stable/c/ba72ed1c8476ce68eb7152dfcbc5330cefcbaa91
https://git.kernel.org/stable/c/f5b143f4cd3fb7673df8d727550478a4b762908a
https://nvd.nist.gov/vuln/detail/CVE-2026-99041
https://www.cve.org/CVERecord?id=CVE-2026-99041

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2e151c74bcc53e3ed313bd1c21b0d5bb442edbc0 https://git.kernel.org/stable/c/ba72ed1c8476ce68eb7152dfcbc5330cefcbaa91

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99041.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99041 https://www.cve.org/CVERecord?id=CVE-2026-99041
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan_tunnel_xmit() treats that metadata dst as a route. Since it has no output device, dst_dev(dst)->mtu dereferences NULL. On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used self-created user and network namespaces to trigger: KASAN: null-ptr-deref RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0 Kernel panic - not syncing: Fatal exception in interrupt The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig in a better way") changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from __gre6_xmit(). ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route. Remove the stale ERSPAN copy and its now-unused dst variable. This eliminates the metadata-dst dereference and keeps ERSPAN aligned with IPv6 GRE PMTU handling.
Title		ip6_gre: remove obsolete ERSPAN PMTU update
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2d06cb25a497d3a7034ef9d172626c2d6620a0f1 https://git.kernel.org/stable/c/8bc60db48e8cba35488bbd6e1f94aa990afa275a https://git.kernel.org/stable/c/8f27260b989f488760289276377db24fbfb20bfa https://git.kernel.org/stable/c/b14a682ad7d45345701e08f9279d483a1da8b36c https://git.kernel.org/stable/c/f5b143f4cd3fb7673df8d727550478a4b762908a

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:22:00.403Z

Updated: 2026-10-30T12:41:14.790Z

Reserved: 2026-09-25T10:25:14.387Z

Link: CVE-2026-99041

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:27.487

Modified: 2026-10-30T13:21:41.327

Link: CVE-2026-99041

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99041 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T15:00:22Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object