{"apiVersion":"1.0","identifier":"CVE-2026-99074","description":"In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 (-net: ipv4: Cache pmtu for all packet paths if multipath enabled-) made __ip_rt_update_pmtu() update every path. For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh->nh_grp. RCU protects each group-s lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it. A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update_or_create_fnhe+0x45/0x15b0 Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request. Replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.","publishedAt":"2026-10-23T13:17:31","lastModifiedAt":"2026-10-30T13:21:43","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99074","cvssScore":null,"cvssVector":null,"epssProbability":0.00154,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99074","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99074","en":"https://www.redsauce.net/en/cves/CVE-2026-99074","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99074","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99074","de":"https://www.redsauce.net/de/cves/CVE-2026-99074","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99074","el":"https://www.redsauce.net/el/cves/CVE-2026-99074"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99074"}}