Linux Kernel: Incorrect option offsets in IPv4 CIPSO handling
Summary
A flaw in the Linux kernel's IPv4 CIPSO code (cipso_v4_skbuff_delattr) leaves cached offsets of following IP options unadjusted after removing the CIPSO option. Consumers such as ip_forward_options() and __ip_options_echo() can then read wrong packet bytes, which may lead to memory corruption or a crash. Per the CVSS vector, the flaw is remotely reachable without privileges or user interaction, but attack complexity is high and it is relevant only where CIPSO labelled networking is used.
Affected
- Linux kernel from 6.10 up to the fixed stable versions (per OSV and CNA data: fixed in 6.12.113, 6.18.57, 7.2.11)
- Exact ranges differ between sources; verify against your distribution's kernel package
- Unknown: fixed builds for Debian, Ubuntu, RHEL, SUSE and Amazon Linux
Fixed in
- Upstream stable kernels 6.12.113, 6.18.57 and 7.2.11 (per OSV and CNA data)
- Fixed commits: 2200fe1d6148b78e1b8f00f4b2bd47760015077f, 6d25ffca055a77787c21a36b66c253f76239411b, 6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0, b965977126a90e01825814c859ba4788691eddd3
- Distribution fixed versions: Unknown.
Workaround
- None found in the sources. A patched kernel is the only complete remedy.
- If CIPSO/NetLabel is not used on your systems, the flaw is unlikely to be reachable; verify this on each host.
Exploitation
- No evidence of in-the-wild exploitation; not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Check whether CIPSO/NetLabel is configured, especially on routers or firewalls that forward traffic.
- Apply your distribution's kernel updates as soon as they are available and reboot afterwards.
- Check your distribution security tracker for CVE-2026-99064, since fixed versions are not yet consistent.
- Monitor the NVD and distribution status until analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 2200fe1d git.kernel.org
- Linux kernel stable commit 6d25ffca git.kernel.org
- Linux kernel stable commit 6e49d611 git.kernel.org
- Linux kernel stable commit b9659771 git.kernel.org
- Ubuntu security tracker CVE-2026-99064 ubuntu.com
- OSV Bell-SW BELL-CVE-2026-99064 osv.dev
- OffSeq threat radar CVE-2026-99064 radar.offseq.com
- Vulners NVD CVE-2026-99064 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:55.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a seven-byte RR option, parsing records rr at offset 30. Removing CIPSO moves RR to offset 20, while the cached offset remains 30. Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes; the latter may interpret packet data as the option length and copy it into fixed-size option storage. Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and router_alert offsets when they follow CIPSO. cipso_len is the distance the first memmove() shifts those options. The later header move and network-header reset relocate the bytes and their offset base together.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.