CVE-2026-99999

9.3Critical

Published 15 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.3Critical

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: —

Impact

A local attacker can corrupt kernel memory and compromise host integrity or crash the system. Exploitation requires sending specially crafted packets with malformed checksum metadata into the local IPv4 stack.

Root cause

The IPv4 networking stack processes malformed packets without validating checksum_start offsets, causing skb_checksum_help to overwrite adjacent network header memory.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade the Linux kernel to a release incorporating the patch commit. No workaround or configuration mitigation is currently available.

shell

$ uname -r

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-99999