Bug in the Linux kernel occurs when __ip_rt_update_pmtu() walks through all paths of a nexthop group while the group is being replaced concurrently. The group pointer loads are not synchronized, so the walk can encounter an index that no longer exists, leading to a null pointer dereference inside update_or_create_fnhe(). This triggers a kernel oops, observed as a KASAN error, and results in a system crash.

All Linux kernel releases that include the PMTU update optimization for multipath routing and that have multipath enabled until the fix is applied. The defect was demonstrated on kernel 7.2 and can be triggered by replacing a two‑member route group with a one‑member group using RTM_NEWNEXTHOP. Administrators who can grant CAP_NET_ADMIN or create user namespaces that obtain CAP_NET_ADMIN are potentially able to trigger the vulnerable operation.

The vulnerability is not listed in CISA KEV and has an EPSS score of <1%, indicating a low likelihood of exploitation. A local attacker who can obtain CAP_NET_ADMIN—either directly or through a user namespace that grants it—can perform the replacement operation. Because the outcome is a kernel crash, the risk level is high for systems where uptime is critical. The CVSS score of 5.5 reflects moderate severity. Remote exploitation is unlikely without the required privileges.