CVE-2026-99074: ipv4: stop PMTU walk when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved:

ipv4: stop PMTU walk when nexthop group shrinks

Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made iprtupdatepmtu() update every path.

For nexthop objects, fibinfonumpath() and fibinfonhc() independently load nh->nhgrp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fibinfonhc() returns NULL and updateorcreatefnhe() dereferences it.

A deterministic probe only widened the existing window between the real operations. On v7.2, an RTMNEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing:

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: updateorcreatefnhe+0x45/0x15b0

Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request.

Replacement requires CAPNETADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.