CVE-2026-99999 - Vulnerability Details

- ipv4: validate checksum_start before completing checksum

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksum_start before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.

This was discovered and reported by Paulos, and has been reporoduced
by others independently since.

We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

Published: 2026-10-15

Score: 9.3 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw lies in the IPv4 packet processing path of the Linux kernel where the checksum start value is not validated before completing the checksum calculation. A packet that carries malformed checksum metadata can cause the skb_checksum_help routine to write beyond the bounds of the network header, resulting in an out‑of‑bounds write and memory corruption. This corruption can destabilize the system, trigger a crash, or provide a foothold for further exploitation if the corrupted kernel state can be leveraged by an attacker.

Affected Systems

All Linux kernel implementations that have not yet integrated the checksum validation patch are affected. No specific version ranges are listed in the CNA data, so the impact applies broadly across every unpatched kernel release from any distribution.

Risk and Exploitability

The CVSS score of 9.3 places the issue in the critical range, while the EPSS score of less than 1% suggests that it is unlikely to be seen widely in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be network‑based, requiring an attacker to transmit specially crafted IPv4 packets to the target system to trigger the fault.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< a464d950f31c89565cbaae038cc60db04fe01956
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< 0fab003ef4698e0628060a45a48f14b43ba2a40a
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< 94524b7b32691de2e2ce162c04d6cbc9106e5cbf
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< a65f69e0f38ffbed1b128029e09097436416dc8b
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< 32a8b0adaa18e52aaa0b246b5ffe683075354dbb
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< f3e835af6226f1dd12160cbd696081e9b6155de0
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< c3e33464746166264334641dc850a36eef7e6326
`f43798c27684ab925adde7d8acc34c78c6e50df8`	affected	< 6785011f8b16abf40b1e9d8b2e332232b3e68822

Linux

affected

Version	Status	Constraints
`2.6.27`	affected	—
`0`	unaffected	< 2.6.27
`5.10.272`	unaffected	≤ 5.10.*
`5.15.223`	unaffected	≤ 5.15.*
`6.1.190`	unaffected	≤ 6.1.*
`6.6.159`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f43798c27684ab925adde7d8acc34c78c6e50df8,a464d950f31c89565cbaae038cc60db04fe01956)`	affected	code_commit	—
`[f43798c27684ab925adde7d8acc34c78c6e50df8,0fab003ef4698e0628060a45a48f14b43ba2a40a)`	affected	code_commit	—
`[f43798c27684ab925adde7d8acc34c78c6e50df8,94524b7b32691de2e2ce162c04d6cbc9106e5cbf)`	affected	code_commit	—
`[f43798c27684ab925adde7d8acc34c78c6e50df8,a65f69e0f38ffbed1b128029e09097436416dc8b)`	affected	code_commit	—
`[f43798c27684ab925adde7d8acc34c78c6e50df8,32a8b0adaa18e52aaa0b246b5ffe683075354dbb)`	affected	code_commit	—
`[f43798c27684ab925adde7d8acc34c78c6e50df8,f3e835af6226f1dd12160cbd696081e9b6155de0)`	affected	code_commit	—
`[f43798c27684ab925adde7d8acc34c78c6e50df8,c3e33464746166264334641dc850a36eef7e6326)`	affected	code_commit	—
`[f43798c27684ab925adde7d8acc34c78c6e50df8,6785011f8b16abf40b1e9d8b2e332232b3e68822)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.27`	affected	semver	—
`[0,2.6.27)`	unaffected	semver	—
`[5.10.272,5.11.0)`	unaffected	semver	—
`[5.15.223,5.16.0)`	unaffected	semver	—
`[6.1.190,6.2.0)`	unaffected	semver	—
`[6.6.159,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel release that incorporates the checksum validation patch from the Linux kernel maintainers.
Reboot the system to ensure the patched kernel is active.
If a kernel update cannot be performed immediately, configure network devices or firewall rules to drop or reset connections that generate checksum mismatches and monitor for anomalous traffic patterns.

Generated by OpenCVE AI on October 20, 2026 at 12:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00788.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/10/15/5
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox
https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a
https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb
https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822
https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf
https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956
https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b
https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326
https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0
https://nvd.nist.gov/vuln/detail/CVE-2026-99999
https://pwn.ai/blog/pwnescape
https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
https://www.cve.org/CVERecord?id=CVE-2026-99999

History

Mon, 19 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Mon, 19 Oct 2026 10:30:00 +0000

Type	Values Removed	Values Added
References	https://pwn.ai/blog/Pwnescape

Sat, 17 Oct 2026 11:30:00 +0000

Type	Values Removed	Values Added
References		https://pwn.ai/blog/pwnescape

Fri, 16 Oct 2026 23:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-20

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 16 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99999 https://www.cve.org/CVERecord?id=CVE-2026-99999
Metrics	threat_severity `None`	threat_severity `Critical`

Fri, 16 Oct 2026 07:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-20

Thu, 15 Oct 2026 23:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/10/15/5

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
Title		ipv4: validate checksum_start before completing checksum
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822 https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956 https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326 https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0 https://pwn.ai/blog/Pwnescape https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
Metrics		cvssV3_1 `{'score': 9.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-15T12:19:22.784Z

Updated: 2026-10-24T14:17:15.740Z

Reserved: 2026-09-25T10:25:14.451Z

Link: CVE-2026-99999

Vulnrichment

Updated: 2026-10-15T22:07:24.590Z

NVD

Status : Received

Published: 2026-10-15T13:17:14.137

Modified: 2026-10-19T22:17:28.667

Link: CVE-2026-99999

Redhat

Severity : Critical

Publid Date: 2026-10-15T00:00:00Z

Links: CVE-2026-99999 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T12:45:15Z

Weaknesses

CWE-20
Improper Input Validation
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object