--- id: CVE-2026-99999 title: |- In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea… summary: |- In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea… severity: critical cvss: 9.3 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H' vendor: Linux product: Linux affected: - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < a464d950f31c89565cbaae038cc60db04fe01956 - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 0fab003ef4698e0628060a45a48f14b43ba2a40a - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 94524b7b32691de2e2ce162c04d6cbc9106e5cbf - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < a65f69e0f38ffbed1b128029e09097436416dc8b - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 32a8b0adaa18e52aaa0b246b5ffe683075354dbb - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < f3e835af6226f1dd12160cbd696081e9b6155de0 - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < c3e33464746166264334641dc850a36eef7e6326 - >- Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 6785011f8b16abf40b1e9d8b2e332232b3e68822 - Linux 2.6.27 published: '2026-10-15' updated: '2026-10-15' sourceUpdated: '2026-10-15T13:17:14.137' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-99999' references: - url: 'https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://pwn.ai/blog/Pwnescape' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: >- https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-99999.json - url: 'https://access.redhat.com/security/cve/CVE-2026-99999' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2553429' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-99999' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-99999' - url: >- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox - url: 'https://access.redhat.com/errata/RHSA-2026:85979' - url: 'https://access.redhat.com/errata/RHSA-2026:86089' - url: 'https://access.redhat.com/errata/RHSA-2026:86033' - url: 'https://access.redhat.com/errata/RHSA-2026:85928' - url: 'https://access.redhat.com/errata/RHSA-2026:85321' - url: 'https://access.redhat.com/errata/RHSA-2026:88206' - url: 'https://access.redhat.com/errata/RHSA-2026:88204' - url: 'https://access.redhat.com/errata/RHSA-2026:87821' - url: 'https://access.redhat.com/errata/RHSA-2026:87264' - url: 'https://access.redhat.com/errata/RHSA-2026:89083' - url: 'https://access.redhat.com/errata/RHSA-2026:87091' - url: 'https://access.redhat.com/errata/RHSA-2026:87086' - url: 'https://access.redhat.com/errata/RHSA-2026:87098' - url: 'https://access.redhat.com/errata/RHSA-2026:87822' tags: - nvd - cve.org - csaf - vex - red-hat - exploit-available ingestedAt: '2026-10-15T13:06:33.282Z' cwe: - CWE-787 scores: nvd: 9.3 vendor: 8.8 cna: 9.3 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T15:49:03.519458Z' epss: 0.00323 epssPercentile: 0.24108 exploits: github: 13 githubRepos: - 'https://github.com/PeronGH/CVE-2026-99999' - 'https://github.com/01luyicheng/CVE-2026-99999' - 'https://github.com/gandli/CVE-2026-99999-pwnescape' checkedAt: '2026-10-25T00:52:19.018Z' exploitAvailable: true patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_e4s_v_9_4 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_real_time_for_nfv_eus_v_10_0 - enterprise_linux_real_time_for_nfv_e4s_v_9_4 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_eus_v_10_0 - enterprise_linux_real_time_e4s_v_9_4 - enterprise_linux_real_time_v_9 --- ## Overview In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-99999.json) - **RHSA-2026:85979** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85979) - **RHSA-2026:86089** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86089) - **RHSA-2026:86033** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86033) - **RHSA-2026:85928** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:85928) - **RHSA-2026:85321** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85321) - **RHSA-2026:88206** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88206) - **RHSA-2026:88204** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time (v. 7 ELS) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88204) - **RHSA-2026:87821** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:87821) - **RHSA-2026:87264** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:87264) - **RHSA-2026:89083** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:89083) - **RHSA-2026:87091** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87091)