In the Linux kernel, the following vulnerability has been resolved:
ipv4: validate checksum_start before completing checksum
If a packet with bad checksum metadata gets into the ipv4 stack,
This was discovered and reported by Paulos, and has been reporoduced
We really shouldn't allow such packets in, but as a defence
A more complete validation at input is forthcoming, but needs more work.
Published:
2026-10-15
Score:
9.3 Critical
EPSS:
< 1% Very Low
KEV:
No
Impact:
Memory Corruption
Action:
Patch
Impact
The flaw lies in the IPv4 packet processing path of the Linux kernel where the checksum start value is not validated before completing the checksum calculation. A packet that carries malformed checksum metadata can cause the skb_checksum_help routine to write beyond the bounds of the network header, resulting in an out‑of‑bounds write and memory corruption. This corruption can destabilize the system, trigger a crash, or provide a foothold for further exploitation if the corrupted kernel state can be leveraged by an attacker.
Affected Systems
All Linux kernel implementations that have not yet integrated the checksum validation patch are affected. No specific version ranges are listed in the CNA data, so the impact applies broadly across every unpatched kernel release from any distribution.
Risk and Exploitability
The CVSS score of 9.3 places the issue in the critical range, while the EPSS score of less than 1% suggests that it is unlikely to be seen widely in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be network‑based, requiring an attacker to transmit specially crafted IPv4 packets to the target system to trigger the fault.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
Vendor
Product
Default status
Versions
Linux
Linux
unaffected
Version
Status
Constraints
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< a464d950f31c89565cbaae038cc60db04fe01956
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< 0fab003ef4698e0628060a45a48f14b43ba2a40a
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< 94524b7b32691de2e2ce162c04d6cbc9106e5cbf
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< a65f69e0f38ffbed1b128029e09097436416dc8b
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< 32a8b0adaa18e52aaa0b246b5ffe683075354dbb
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< f3e835af6226f1dd12160cbd696081e9b6155de0
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< c3e33464746166264334641dc850a36eef7e6326
f43798c27684ab925adde7d8acc34c78c6e50df8
affected
< 6785011f8b16abf40b1e9d8b2e332232b3e68822
Linux
Linux
affected
Version
Status
Constraints
2.6.27
affected
—
0
unaffected
< 2.6.27
5.10.272
unaffected
≤ 5.10.*
5.15.223
unaffected
≤ 5.15.*
6.1.190
unaffected
≤ 6.1.*
6.6.159
unaffected
≤ 6.6.*
6.12.113
unaffected
≤ 6.12.*
6.18.57
unaffected
≤ 6.18.*
7.2.11
unaffected
≤ 7.2.*
7.3
unaffected
≤ *
No data.
No data.
Vendor
Product
Confidence
Versions
Linux
Linux Kernel
99%
Version
Status
Scheme
Platform
[f43798c27684ab925adde7d8acc34c78c6e50df8,a464d950f31c89565cbaae038cc60db04fe01956)
affected
code_commit
—
[f43798c27684ab925adde7d8acc34c78c6e50df8,0fab003ef4698e0628060a45a48f14b43ba2a40a)
affected
code_commit
—
[f43798c27684ab925adde7d8acc34c78c6e50df8,94524b7b32691de2e2ce162c04d6cbc9106e5cbf)
affected
code_commit
—
[f43798c27684ab925adde7d8acc34c78c6e50df8,a65f69e0f38ffbed1b128029e09097436416dc8b)
affected
code_commit
—
[f43798c27684ab925adde7d8acc34c78c6e50df8,32a8b0adaa18e52aaa0b246b5ffe683075354dbb)
affected
code_commit
—
[f43798c27684ab925adde7d8acc34c78c6e50df8,f3e835af6226f1dd12160cbd696081e9b6155de0)
affected
code_commit
—
[f43798c27684ab925adde7d8acc34c78c6e50df8,c3e33464746166264334641dc850a36eef7e6326)
affected
code_commit
—
[f43798c27684ab925adde7d8acc34c78c6e50df8,6785011f8b16abf40b1e9d8b2e332232b3e68822)
affected
code_commit
—
Linux
Linux Kernel
99%
Version
Status
Scheme
Platform
2.6.27
affected
semver
—
[0,2.6.27)
unaffected
semver
—
[5.10.272,5.11.0)
unaffected
semver
—
[5.15.223,5.16.0)
unaffected
semver
—
[6.1.190,6.2.0)
unaffected
semver
—
[6.6.159,6.7.0)
unaffected
semver
—
[6.12.113,6.13.0)
unaffected
semver
—
[6.18.57,6.19.0)
unaffected
semver
—
[7.2.11,7.3.0)
unaffected
semver
—
[7.3,*]
unaffected
generic
—
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Sign in to view the affected projects.
No CVSS v4.0
Confidentiality Impact
High
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
The EPSS score is 0.00788 .
Type
Values Removed
Values Added
Weaknesses
CWE-20
Type
Values Removed
Values Added
Weaknesses
CWE-119
Type
Values Removed
Values Added
Metrics
ssvc
{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type
Values Removed
Values Added
Weaknesses
CWE-119
Status: PUBLISHED
Assigner: Linux
Published:
2026-10-15T12:19:22.784Z
Updated: 2026-10-24T14:17:15.740Z
Reserved: 2026-09-25T10:25:14.451Z
Link: CVE-2026-99999
Updated: 2026-10-15T22:07:24.590Z
Status : Received
Published: 2026-10-15T13:17:14.137
Modified: 2026-10-19T22:17:28.667
Link: CVE-2026-99999
Updated: 2026-10-20T12:45:15Z
{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99999", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.451Z", "datePublished": "2026-10-15T12:19:22.784Z", "dateUpdated": "2026-10-24T14:17:15.740Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:17:15.740Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb's logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "versions": [{"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "a464d950f31c89565cbaae038cc60db04fe01956", "status": "affected", "versionType": "git"}, {"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a", "status": "affected", "versionType": "git"}, {"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf", "status": "affected", "versionType": "git"}, {"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b", "status": "affected", "versionType": "git"}, {"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb", "status": "affected", "versionType": "git"}, {"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0", "status": "affected", "versionType": "git"}, {"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "c3e33464746166264334641dc850a36eef7e6326", "status": "affected", "versionType": "git"}, {"version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "versions": [{"version": "2.6.27", "status": "affected"}, {"version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.272", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.223", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.190", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.159", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.10.272"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.15.223"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.1.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.6.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"}, {"url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"}, {"url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"}, {"url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"}, {"url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"}, {"url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"}, {"url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"}, {"url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"}, {"url": "https://pwn.ai/blog/pwnescape"}, {"url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"}], "title": "ipv4: validate checksum_start before completing checksum", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-15T22:07:24.590Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-99999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:03.519458Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:19:28.844Z"}}]}}
{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-15T22:07:24.590Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-99999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:03.519458Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:49:10.811Z"}}], "cna": {"title": "ipv4: validate checksum_start before completing checksum", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb's logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "a464d950f31c89565cbaae038cc60db04fe01956", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "c3e33464746166264334641dc850a36eef7e6326", "versionType": "git"}, {"status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822", "versionType": "git"}], "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.27", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.272", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.223", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.190", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.159", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.113", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.11", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"}, {"url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"}, {"url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"}, {"url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"}, {"url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"}, {"url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"}, {"url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"}, {"url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"}, {"url": "https://pwn.ai/blog/pwnescape"}, {"url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.272", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.223", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.190", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.159", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.113", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.57", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.11", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "2.6.27"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:17:15.740Z"}}}, "cveMetadata": {"cveId": "CVE-2026-99999", "state": "PUBLISHED", "dateUpdated": "2026-10-24T14:17:15.740Z", "dateReserved": "2026-09-25T10:25:14.451Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-10-15T12:19:22.784Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}
{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a464d950f31c89565cbaae038cc60db04fe01956", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}, {"lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}, {"lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}, {"lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}, {"lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}, {"lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}, {"lessThan": "c3e33464746166264334641dc850a36eef7e6326", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}, {"lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822", "status": "affected", "version": "f43798c27684ab925adde7d8acc34c78c6e50df8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/ip.h", "net/bridge/netfilter/nf_conntrack_bridge.c", "net/ipv4/ip_output.c", "net/netfilter/nfnetlink_queue.c", "net/netfilter/xt_CHECKSUM.c", "net/xfrm/xfrm_output.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.272", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.223", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.190", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.159", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."}], "id": "CVE-2026-99999", "lastModified": "2026-10-19T22:17:28.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-99999", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:49:03.519458Z", "version": "2.0.3"}}]}, "published": "2026-10-15T13:17:14.137", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://pwn.ai/blog/pwnescape"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}
{"bugzilla": {"description": "kernel: ipv4: validate checksum_start before completing checksum", "id": "2553429", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553429"}, "csaw": true, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-99999", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99999\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99999\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox"], "threat_severity": "Critical"}
{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,a464d950f31c89565cbaae038cc60db04fe01956)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,0fab003ef4698e0628060a45a48f14b43ba2a40a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,94524b7b32691de2e2ce162c04d6cbc9106e5cbf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,a65f69e0f38ffbed1b128029e09097436416dc8b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,32a8b0adaa18e52aaa0b246b5ffe683075354dbb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,f3e835af6226f1dd12160cbd696081e9b6155de0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,c3e33464746166264334641dc850a36eef7e6326)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f43798c27684ab925adde7d8acc34c78c6e50df8,6785011f8b16abf40b1e9d8b2e332232b3e68822)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.27"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.27)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.272,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.223,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.190,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.159,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-16T07:15:17.908827+00:00", "updated": "2026-10-20T12:45:15.243207+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-20", "CWE-787"]}
Mitre Data 
CPE Configurations
Affected Packages
OpenCVE Enrichment