All vulnerabilities
CVE-2026-99041

Linux: ip6_gre: remove obsolete ERSPAN PMTU update

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2d06cb25a497d3a7034ef9d172626c2d6620a0f1Also 8f27260b989f488760289276377db24fbfb20bfa, 8bc60db48e8cba35488bbd6e1f94aa990afa275aCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 2d06cb25a497d3a7034ef9d172626c2d6620a0f1LinuxCVE List
  • 8f27260b989f488760289276377db24fbfb20bfaLinuxCVE List
  • 8bc60db48e8cba35488bbd6e1f94aa990afa275aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: remove obsolete ERSPAN PMTU update

A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan_tunnel_xmit() treats that metadata dst as a route. Since it has no output device, dst_dev(dst)->mtu dereferences NULL.

On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used self-created user and network namespaces to trigger:

KASAN: null-ptr-deref RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0 Kernel panic - not syncing: Fatal exception in interrupt

The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig in a better way") changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from __gre6_xmit(). ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.

Remove the stale ERSPAN copy and its now-unused dst variable. This eliminates the metadata-dst dereference and keeps ERSPAN aligned with IPv6 GRE PMTU handling.

Text from CVE List

Affected versions 12

  • Linuxaffected: 5a963eb61b7c39e6c422b6e48619d19d04719358 before b14a682ad7d45345701e08f9279d483a1da8b36cCVE List
  • Linuxaffected: 5a963eb61b7c39e6c422b6e48619d19d04719358 before f5b143f4cd3fb7673df8d727550478a4b762908aCVE List
  • Linuxaffected: 5a963eb61b7c39e6c422b6e48619d19d04719358 before 2d06cb25a497d3a7034ef9d172626c2d6620a0f1CVE List
  • Linuxaffected: 5a963eb61b7c39e6c422b6e48619d19d04719358 before 8f27260b989f488760289276377db24fbfb20bfaCVE List
  • Linuxaffected: 5a963eb61b7c39e6c422b6e48619d19d04719358 before 8bc60db48e8cba35488bbd6e1f94aa990afa275aCVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.58 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5