# CVE-2026-99041: ip6_gre: remove obsolete ERSPAN PMTU update

CVE-2026-99041 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99041, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-99041
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 23, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99041

## Description

In the Linux kernel, the following vulnerability has been resolved:  ip6_gre: remove obsolete ERSPAN PMTU update  A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan_tunnel_xmit() treats that metadata dst as a route. Since it has no output device, dst_dev(dst)->mtu dereferences NULL.  On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used self-created user and network namespaces to trigger:    KASAN: null-ptr-deref   RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0   Kernel panic - not syncing: Fatal exception in interrupt  The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig in a better way") changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from __gre6_xmit(). ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.  Remove the stale ERSPAN copy and its now-unused dst variable. This eliminates the metadata-dst dereference and keeps ERSPAN aligned with IPv6 GRE PMTU handling.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-99041](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99041.md) | Oct 24, 2026 |
| Linux | linux Debian 14 | 7.2.11-1 | [DEBIAN-CVE-2026-99041](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99041.md) | Oct 24, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.