Vulnerability-Lookup

ESSA-2026:0197

Vulnerability from csaf_opensuse - Published: 2026-10-20 02:42 - Updated: 2026-10-21 19:00

Summary

Important: kernel security, bug fix, and enhancement update

Severity

Moderate

Notes

Title of the patch: Important: kernel security, bug fix, and enhancement update

Description of the patch: The kernel packages contain the Linux kernel, the core of any Linux operating system.Security Fix(es): kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): gfs2 filesystem withdrawal rework [RHEL-8] (JIRA:RHEL-129363) Batch: z-stream xfrm - rhel-8.10.z (NST-Core-26W38) (JIRA:RHEL-256684) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Patchnames: ESSA-2026:0197

CVE-2026-99999

8.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:perf-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64	—	Vendor Fix

Threats

Impact important

References

9 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/e…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-99999/	self
https://www.suse.com/security/cve/CVE-2026-99999	external
https://bugzilla.suse.com/1285684	external
https://bugzilla.suse.com/1285687	external
https://bugzilla.suse.com/1286031	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Important: kernel security, bug fix, and enhancement update",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "The kernel packages contain the Linux kernel, the core of any Linux operating system.Security Fix(es): kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) \n kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) \n kernel: sctp: keep chunk-\u003etransport in step with the list it is queued on (CVE-2026-74588) \n kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) \n kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) \n kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) \n kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) \n kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) \n kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () \n kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) \nBug Fix(es) and Enhancement(s):  gfs2 filesystem withdrawal rework [RHEL-8] (JIRA:RHEL-129363) \n Batch: z-stream xfrm - rhel-8.10.z (NST-Core-26W38) (JIRA:RHEL-256684) \nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "ESSA-2026:0197",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/essa-2026_0197.json"
      },
      {
        "category": "self",
        "summary": "URL for ESSA-2026:0197",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008283.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for ESSA-2026:0197",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008283.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-99999 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-99999/"
      }
    ],
    "title": "Important: kernel security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-21T19:00:24Z",
      "generator": {
        "date": "2026-10-20T02:42:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "ESSA-2026:0197",
      "initial_release_date": "2026-10-20T02:42:00Z",
      "revision_history": [
        {
          "date": "2026-10-20T02:42:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-21T11:46:38Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-21T19:00:24Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch",
                "product": {
                  "name": "kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch",
                  "product_id": "kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-abi-stablelists@4.18.0-553.176.1.el8_10.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch",
                "product": {
                  "name": "kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch",
                  "product_id": "kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-doc@4.18.0-553.176.1.el8_10.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bpftool@4.18.0-553.176.1.el8_10.1?arch=x86_64\u0026upstream=bpftool-0:4.18.0-553.176.1.el8_10.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-core@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-cross-headers@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug@4.18.0-553.176.1.el8_10.1?arch=x86_64\u0026upstream=kernel-debug-0:4.18.0-553.176.1.el8_10.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-core@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug-devel@4.18.0-553.176.1.el8_10.1?arch=x86_64\u0026upstream=kernel-debug-0:4.18.0-553.176.1.el8_10.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-modules@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-modules-extra@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@4.18.0-553.176.1.el8_10.1?arch=x86_64\u0026upstream=kernel-source-0:4.18.0-553.176.1.el8_10.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-headers@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-modules@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-modules-extra@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs-devel@4.18.0-553.176.1.el8_10.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perf@4.18.0-553.176.1.el8_10.1?arch=x86_64\u0026upstream=perf-0:4.18.0-553.176.1.el8_10.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
                "product": {
                  "name": "python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_id": "python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python3-perf@4.18.0-553.176.1.el8_10.1?arch=x86_64\u0026upstream=perf-0:4.18.0-553.176.1.el8_10.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch"
        },
        "product_reference": "kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch"
        },
        "product_reference": "kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perf-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:perf-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64"
        },
        "product_reference": "python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-99999",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-99999"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch",
          "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch",
          "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
          "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-99999",
          "url": "https://www.suse.com/security/cve/CVE-2026-99999"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285684 for CVE-2026-99999",
          "url": "https://bugzilla.suse.com/1285684"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285687 for CVE-2026-99999",
          "url": "https://bugzilla.suse.com/1285687"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286031 for CVE-2026-99999",
          "url": "https://bugzilla.suse.com/1286031"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.176.1.el8_10.1.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.176.1.el8_10.1.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.176.1.el8_10.1.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.176.1.el8_10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-20T02:42:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-99999"
    }
  ]
}

CVE-2026-99999 (GCVE-0-2026-99999)

Vulnerability from cvelistv5 – Published: 2026-10-15 12:19 – Updated: 2026-10-19 21:19

Title

ipv4: validate checksum_start before completing checksum

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:49 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6843 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/a464d950f31c89565…
https://git.kernel.org/stable/c/0fab003ef4698e062…
https://git.kernel.org/stable/c/94524b7b32691de2e…
https://git.kernel.org/stable/c/a65f69e0f38ffbed1…
https://git.kernel.org/stable/c/32a8b0adaa18e52aa…
https://git.kernel.org/stable/c/f3e835af6226f1dd1…
https://git.kernel.org/stable/c/c3e33464746166264…
https://git.kernel.org/stable/c/6785011f8b16abf40…
https://pwn.ai/blog/pwnescape
https://vercel.com/blog/findings-from-the-1-milli…
http://www.openwall.com/lists/oss-security/2026/10/15/5

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < a464d950f31c89565cbaae038cc60db04fe01956 (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 0fab003ef4698e0628060a45a48f14b43ba2a40a (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 94524b7b32691de2e2ce162c04d6cbc9106e5cbf (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < a65f69e0f38ffbed1b128029e09097436416dc8b (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 32a8b0adaa18e52aaa0b246b5ffe683075354dbb (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < f3e835af6226f1dd12160cbd696081e9b6155de0 (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < c3e33464746166264334641dc850a36eef7e6326 (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 6785011f8b16abf40b1e9d8b2e332232b3e68822 (git)
Linux	Linux	Affected: 2.6.27 Unaffected: 0 , < 2.6.27 (semver) Unaffected: 5.10.272 , ≤ 5.10.* (semver) Unaffected: 5.15.223 , ≤ 5.15.* (semver) Unaffected: 6.1.190 , ≤ 6.1.* (semver) Unaffected: 6.6.159 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:07:24.590Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-99999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:03.519458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:28.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a464d950f31c89565cbaae038cc60db04fe01956",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "c3e33464746166264334641dc850a36eef7e6326",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.272",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.223",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.190",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.159",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb\u0027s logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it. -- Thanks, Sasha"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:27:03.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"
        },
        {
          "url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"
        },
        {
          "url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"
        },
        {
          "url": "https://pwn.ai/blog/pwnescape"
        },
        {
          "url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"
        }
      ],
      "title": "ipv4: validate checksum_start before completing checksum",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99999",
    "datePublished": "2026-10-15T12:19:22.784Z",
    "dateReserved": "2026-09-25T10:25:14.451Z",
    "dateUpdated": "2026-10-19T21:19:28.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted