CVE-2026-99074 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining and securing Linux-based systems. These individuals should review and apply patches, restrict access to network administration capabilities, and monitor system logs to mitigate the vulnerability. The vulnerability's impact can be mitigated by verifying Linux kernel versions and applying patches to prevent potential null-pointer dereferences.

Why it matters

This vulnerability in the Linux kernel's IPv4 implementation can lead to a null-pointer dereference when a nexthop group shrinks. Linux kernel developers and administrators should review and apply patches, restrict access to network administration capabilities, and monitor system logs.

• Verify Linux kernel versions and apply patches to prevent potential null-pointer dereferences
• Restrict access to network administration capabilities to trusted users
• Monitor system logs for potential exploitation attempts

Technical summary

The Linux kernel's IPv4 implementation has a vulnerability where the PMTU walk may not stop when a nexthop group shrinks, leading to a potential null-pointer dereference. This issue requires CAP_NET_ADMIN in the network namespace. The vulnerability was resolved through specific commits in the Linux kernel, including updates to handle nexthop group changes properly. The changes ensure that the PMTU walk stops when the indexed path is absent, preventing null-pointer dereferences. Linux kernel developers and administrators should review and apply patches, restrict access to network administration capabilities, and monitor system logs.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Restrict access to network administration capabilities to trusted users
• Monitor for potential exploitation attempts
• Verify Linux kernel versions and apply patches to prevent potential null-pointer dereferences
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved in the Linux kernel through commits that address the PMTU walk issue when a nexthop group shrinks. Multiple commits are referenced as part of the fix, including 82d83eec893d8ae84f280aec44c60d9fdecc62b5 and a411df69524f91fe3adb8f9544d33e701fc9732c. These changes ensure that the PMTU walk stops when the indexed path is absent, preventing null-pointer dereferences. The source details are limited, and explicit evidence-limit language is used to frame the vulnerability and its mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.