NULL pointer dereference in Linux kernel - CVE-2026-99041
Published: October 23, 2026
Vulnerability identifier: #VU157460
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99041
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.
The vulnerability exists due to a null pointer dereference in ip6erspan_tunnel_xmit() when obsolete path MTU handling treats tunnel metadata attached to a packet as a route with an output device. A local user can use tc tunnel_key to attach METADATA_IP_TUNNEL metadata and mirred to redirect the packet to a native ip6erspan device to trigger a kernel panic.
The reported reproduction used self-created user and network namespaces.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99041
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2
External References
- https://git.kernel.org/stable/c/2d06cb25a497d3a7034ef9d172626c2d6620a0f1
- https://git.kernel.org/stable/c/8bc60db48e8cba35488bbd6e1f94aa990afa275a
- https://git.kernel.org/stable/c/8f27260b989f488760289276377db24fbfb20bfa
- https://git.kernel.org/stable/c/b14a682ad7d45345701e08f9279d483a1da8b36c
- https://git.kernel.org/stable/c/f5b143f4cd3fb7673df8d727550478a4b762908a