CVE-2026-99074

In the Linux kernel, the following vulnerability has been resolved:

ipv4: stop PMTU walk when nexthop group shrinks

Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made ip rt update pmtu() update every path.

For nexthop objects, fib info num path() and fib info nhc() independently load nh->nh grp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib info nhc() returns NULL and update or create fnhe() dereferences it.

A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing:

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update or create fnhe+0x45/0x15b0

Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request.

Replacement requires CAP NET ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.