{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.11-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv4: stop PMTU walk when nexthop group shrinks  Commit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if multipath enabled\") made __ip_rt_update_pmtu() update every path.  For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh-\u003enh_grp.  RCU protects each group's lifetime but does not make the loads observe the same group.  If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it.  A deterministic probe only widened the existing window between the real operations.  On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing:    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]   RIP: update_or_create_fnhe+0x45/0x15b0  Stop when the indexed path is absent.  Groups are dense, so no later index exists in that snapshot.  The same real-writer window completed 114,423 PMTU iterations without an oops with this check.  A reproducer is available on request.  Replacement requires CAP_NET_ADMIN in the network namespace.  Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.",
  "id": "DEBIAN-CVE-2026-99074",
  "modified": "2026-10-24T05:47:29.968283186Z",
  "published": "2026-10-23T13:17:31.397Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99074"
    }
  ],
  "upstream": [
    "CVE-2026-99074"
  ]
}