CVE-2026-99041

In the Linux kernel, the following vulnerability has been resolved:

ip6 gre: remove obsolete ERSPAN PMTU update

A tc tunnel key action can attach a METADATA IP TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan tunnel xmit() treats that metadata dst as a route. Since it has no output device, dst dev(dst)->mtu dereferences NULL.

On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used self-created user and network namespaces to trigger:

KASAN: null-ptr-deref RIP: ip6erspan tunnel xmit+0x10fc/0x2cc0 Kernel panic - not syncing: Fatal exception in interrupt

The update is obsolete. Commit fe1a4ca0a2b7 ("ip6 gre: process toobig in a better way") changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from gre6 xmit(). ip6 tnl xmit() then propagates the underlay PMTU to the overlay route.

Remove the stale ERSPAN copy and its now-unused dst variable. This eliminates the metadata-dst dereference and keeps ERSPAN aligned with IPv6 GRE PMTU handling.