CVE-2026-99041 Linux CVE debrief

Who should care

Linux kernel maintainers, developers, and users of systems with ip6_gre functionality should assess exposure in Linux kernel deployments using ip6_gre and prioritize verification of affected versions. They should review and apply patches for affected systems and monitor for potential null pointer dereference issues.

Why it matters

A vulnerability in the Linux kernel's ip6_gre module requires verification and potential patching to prevent null pointer dereferences.

• Potential null pointer dereference in ip6erspan_tunnel_xmit()
• Required verification of affected Linux kernel versions
• Necessary patch application for exposed systems

Technical summary

The Linux kernel's ip6_gre module had an obsolete ERSPAN PMTU update that could cause a null pointer dereference. This has been resolved by removing the obsolete code. The update was obsolete and has been removed, keeping ERSPAN aligned with IPv6 GRE PMTU handling. A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan_tunnel_xmit() treats that metadata dst as a route. Since it has no output device, dst_dev(dst)->mtu dereferences NULL.

Defensive priority

Assess exposure in Linux kernel deployments using ip6_gre and prioritize verification of affected versions.

Recommended defensive actions

• Verify Linux kernel versions and assess exposure
• Review and apply patches for affected systems
• Monitor for potential null pointer dereference issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced due to legacy PMTU update logic in ip6erspan_tunnel_xmit(). This has been resolved by removing the obsolete code. The update is obsolete since commit fe1a4ca0a2b7 (ip6_gre: process toobig in a better way) changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from __gre6_xmit(). ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.