Linux Kernel Vulnerability With PMTU Handling in Network Functions

CVE-2026-99074

What is CVE-2026-99074?

A vulnerability has been identified in the Linux kernel that affects the handling of Path Maximum Transmission Unit (PMTU) in multipath environments. The issue occurs due to inadequate synchronization when updating nexthop group information. Specifically, if the group is modified during the PMTU update process, it can result in a null pointer dereference, potentially leading to system instability or crashes. This vulnerability is exacerbated in scenarios where unprivileged user namespaces are present, allowing a local user to exploit the flaw without elevated privileges. It’s essential for users and administrators to apply patches and security updates to mitigate any risks associated with this vulnerability.

References