01 Record

CVE-2026-99074

ipv4: stop PMTU walk when nexthop group shrinks

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

ipv4: stop PMTU walk when nexthop group shrinks

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.15% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 4.1% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Received. NVD last modified this record on 2026-10-23.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-10-23 12:23Z5 DAYS AGO

Last updated

2026-10-23 12:23Z5 DAYS AGO

Reserved

2026-09-25

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

aabfa2eb8d29bc27d5640ccc091b8f7cecd1a6976c233789be07292ff8d0f6cc

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux3bed2abab4a682d426624ce9add9d7b6d475d4e4 to < 7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a, 7f5005457b3072fe1ddf15bfef869f2a1d98e05e to < c60d17d6dd61adc761ac6f65a008fefbc54cbf87, 7d3f3b4367f315a61fc615e3138f3d320da8c466 to < c6d670ac656badfd0e15355e07a13a6bdf3b69fd, 7d3f3b4367f315a61fc615e3138f3d320da8c466 to < f27483f9975b5065ff67054cc7eb8edac6083488, 7d3f3b4367f315a61fc615e3138f3d320da8c466 to < 6619e01855e65ef35723685a557e3eb106f4ecf5, fc07a232326a623d0be482e307c08ea7049c2846, b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e, 6.6.79 to < 6.6.160, 6.12.16 to < 6.12.113, 5.15.179 to < 5.16, 6.1.129 to < 6.2, 6.13—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a
git.kernel.orghttps://git.kernel.org/stable/c/c60d17d6dd61adc761ac6f65a008fefbc54cbf87
git.kernel.orghttps://git.kernel.org/stable/c/c6d670ac656badfd0e15355e07a13a6bdf3b69fd
git.kernel.orghttps://git.kernel.org/stable/c/f27483f9975b5065ff67054cc7eb8edac6083488
git.kernel.orghttps://git.kernel.org/stable/c/6619e01855e65ef35723685a557e3eb106f4ecf5

07 Fixed in

Debian 12

linux
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.113-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.11-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.