CVE-2026-99999

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a
https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb
https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822
https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf
https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956
https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b
https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326
https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0
https://pwn.ai/blog/pwnescape
https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
http://www.openwall.com/lists/oss-security/2026/10/15/5

Configurations

No configuration.

History

19 Oct 2026, 22:17

Type	Values Removed	Values Added
CWE		CWE-20

19 Oct 2026, 10:19

Type	Values Removed	Values Added
References	~~{'url': 'https://pwn.ai/blog/Pwnescape', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}~~	() https://pwn.ai/blog/pwnescape -

15 Oct 2026, 23:19

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/15/5 -

15 Oct 2026, 13:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 13:17

Updated : 2026-10-19 22:17

NVD link : CVE-2026-99999

Mitre link : CVE-2026-99999

CVE.ORG link : CVE-2026-99999

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-99999", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-99999", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:03.519458Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.5}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "a464d950f31c89565cbaae038cc60db04fe01956", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "c3e33464746166264334641dc850a36eef7e6326", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822", "versionType": "git"}], "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.27", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.272", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.223", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.190", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.159", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.113", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.11", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "defaultStatus": "affected"}]}], "published": "2026-10-15T13:17:14.137", "references": [{"url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://pwn.ai/blog/pwnescape", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/15/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."}], "lastModified": "2026-10-19T22:17:28.667", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}