CVE-2026-99041: ip6_gre: remove obsolete ERSPAN PMTU update

In the Linux kernel, the following vulnerability has been resolved:

ip6gre: remove obsolete ERSPAN PMTU update

A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit() treats that metadata dst as a route. Since it has no output device, dstdev(dst)->mtu dereferences NULL.

On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used self-created user and network namespaces to trigger:

KASAN: null-ptr-deref RIP: ip6erspantunnelxmit+0x10fc/0x2cc0 Kernel panic - not syncing: Fatal exception in interrupt

The update is obsolete. Commit fe1a4ca0a2b7 ("ip6gre: process toobig in a better way") changed IPv6 GRE Too Big handling to update the underlay route and removed the equivalent block from gre6xmit(). ip6tnlxmit() then propagates the underlay PMTU to the overlay route.

Remove the stale ERSPAN copy and its now-unused dst variable. This eliminates the metadata-dst dereference and keeps ERSPAN aligned with IPv6 GRE PMTU handling.