CVE-2026-99999
ipv4: validate checksum_start before completing checksum
Reported by linux · Published October 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel-rt-debuginfo-common-x86_64 | errata.rockylinux.org | 4.18.0-553.178.1.rt7.519.el8, 0:4.18.0-553.178.1.rt7.519.el8_10.x86_64 |
| kernel-rt | errata.rockylinux.org | 5.14.0-687.59.1.el9, 0:5.14.0-687.59.1.el9_8.aarch64 |
| kernel-core | errata.rockylinux.org | 6.12.0-211.67.1.el10, 5.14.0-687.59.1.el9, 4.18.0-553.178.1.el8, 0:6.12.0-211.67.1.el10_2.x86_64, 0:5.14.0-687.59.1.el9_8.s390x, 0:4.18.0-553.178.1.el8_10.x86_64 |
| kernel-rt-debug | errata.rockylinux.org | 6.12.0-211.67.1.el10, 0:6.12.0-211.67.1.el10_2.aarch64 |
| kernel-modules-extra | errata.rockylinux.org | 6.12.0-211.67.1.el10, 5.14.0-687.59.1.el9, 0:6.12.0-211.67.1.el10_2.ppc64le, 0:5.14.0-687.59.1.el9_8.x86_64, 0:5.14.0-687.59.1.el9_8.aarch64 |
| kernel-debug-modules | errata.rockylinux.org | 5.14.0-687.59.1.el9, 4.18.0-553.178.1.el8, 0:5.14.0-687.59.1.el9_8.x86_64, 0:4.18.0-553.178.1.el8_10.x86_64, 0:4.18.0-553.178.1.el8_10.aarch64 |
| kernel-modules-extra-matched | errata.rockylinux.org | 6.12.0-211.67.1.el10, 0:6.12.0-211.67.1.el10_2.aarch64 |
| kernel-rt-debug-devel | errata.rockylinux.org | 5.14.0-687.59.1.el9, 0:5.14.0-687.59.1.el9_8.x86_64, 0:5.14.0-687.59.1.el9_8.aarch64 |
| python3-perf-debuginfo | errata.rockylinux.org | 6.12.0-211.67.1.el10, 5.14.0-687.59.1.el9, 0:6.12.0-211.67.1.el10_2.x86_64, 0:5.14.0-687.59.1.el9_8.x86_64, 0:5.14.0-687.59.1.el9_8.aarch64 |
| kernel-64k-modules-extra | errata.rockylinux.org | 6.12.0-211.67.1.el10, 0:6.12.0-211.67.1.el10_2.aarch64 |
| kernel-debug-debuginfo | errata.rockylinux.org | 6.12.0-211.67.1.el10, 5.14.0-687.59.1.el9, 0:6.12.0-211.67.1.el10_2.s390x, 0:6.12.0-211.67.1.el10_2.aarch64, 0:5.14.0-687.59.1.el9_8.x86_64, 0:5.14.0-687.59.1.el9_8.s390x, 0:5.14.0-687.59.1.el9_8.ppc64le |
| perf | errata.rockylinux.org | 6.12.0-211.67.1.el10, 5.14.0-687.59.1.el9, 4.18.0-553.178.1.el8, 0:6.12.0-211.67.1.el10_2.x86_64, 0:5.14.0-687.59.1.el9_8.ppc64le, 0:5.14.0-687.59.1.el9_8.aarch64, 0:4.18.0-553.178.1.el8_10.x86_64 |
54 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | f43798c27684ab925adde7d8acc34c78c6e50df8, f43798c27684ab925adde7d8acc34c78c6e50df8, f43798c27684ab925adde7d8acc34c78c6e50df8 |
| Linux | Linux | 2.6.27, 0, 5.10.272 |
| amazon:2023 | kernel6.12-devel | 0 |
| amazon:2023 | kernel | 0 |
| amazon:2023 | python3-perf6.18 | 0 |
| amazon:2023 | perf | 0 |
| amazon:2023 | kernel-livepatch-6.1.188-233.385 | 0 |
| amazon:2023 | kernel6.18-modules-extra-common | 0 |
| amazon:2023 | kernel-headers | 0 |
| linux | linux_kernel | 2.6.27, 2.6.27, 2.6.27 |
| amazon:2023 | perf6.18 | 0 |
| amazon:2023 | kernel-tools-devel | 0 |
| amazon:2 | python-perf | 0 |
| amazon:2023 | kernel6.12-modules-extra-common | 0 |
| amazon:2023 | kernel-modules-extra-common | 0 |
| amazon:2023 | kernel6.12 | 0 |
| amazon:2 | kernel-tools-devel | 0 |
| amazon:2 | perf | 0 |
| amazon:2023 | kernel-livepatch-6.12.110-135.201 | 0 |
| amazon:2023 | kernel6.12-headers | 0 |
…and 26 more
Timeline
- Sep 30, 2026 CVE Published
- Oct 16, 2026 EPSS Score (6 in total, the first dated here)
- Oct 17, 2026 VulnCheck XDB Entry (3 in total, the first dated here)
- Oct 19, 2026 VulnCheck KEV Exploitation
- Oct 21, 2026 Distribution Patch (11 in total, the first dated here)
- Oct 21, 2026 Security Advisory (8 in total, the first dated here)
- Oct 24, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-99999
vulnetix vdb fixes CVE-2026-99999Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-99999/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart