Linux kernel: Missing checksum validation in IPv4 stack
Summary
The IPv4 stack of the Linux kernel can corrupt the network header when a packet with bad checksum metadata is processed by skb_checksum_help. A local user or an untrusted guest VM can send such packets, which may lead to memory disclosure and a host crash, according to a public research write-up. The fix adds a checksum_start check as defence in depth; the CVSS score differs between sources (9.3 in the CVE record, 8.8 at Red Hat).
Affected
- Linux kernel from 2.6.27 onward (introduced with commit f43798c27684ab925adde7d8acc34c78c6e50df8)
- Until the stable versions listed under 'fixed'
- Red Hat: all tracked product streams marked affected
Fixed in
- Stable kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11 and later
- Debian bookworm 6.1.190-1, trixie 6.12.113-1
- AlmaLinux 8: kernel-4.18.0-553.177.1.el8_10; AlmaLinux 9: kernel-5.14.0-687.59.1.el9_8; AlmaLinux 10: kernel-6.12.0-211.67.1.el10_2
- Other distributions: Unknown, check the vendor advisory
Workaround
- For the kernel itself: Unknown; a patched kernel is the only supported fix.
- CloudLinux suggests, untested and partial: disable checksum offload for untrusted guests and disable unprivileged user namespaces. Disabling checksum offload may affect performance.
Exploitation
- No exploitation in the wild found in the sources.
- The researcher's write-up (pwn.ai) describes a guest-to-host escape in a lab setting, with host memory disclosure and host crash.
- Public exploit code: not confirmed.
Our recommendation
- Identify hypervisor hosts and shared Linux systems where untrusted guests or local users exist, and prioritise them.
- Install the vendor kernel update as soon as it is available and reboot to load it.
- Apply the workarounds only as interim measures and test them first.
- Monitor the advisories of your distribution; single-tenant servers and workstations can follow the normal patch cycle.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (14 repositories)
MChorfa/csumguard · PeronGH/CVE-2026-99999 · Quaerendir/cve-2026-99999-audit · kingahmadr/CVE-2026-99999-kernel-check · nsrg-fmlorg/kpatch-alma-cve-2026-99999
Research sources
- Linux kernel stable commit 6785011f8b16 (fix) git.kernel.org
- AlmaLinux advisory for PwnEscape (CVE-2026-99999) almalinux.org
- Red Hat CVE page CVE-2026-99999 access.redhat.com
- Red Hat erratum RHSA-2026:87098 access.redhat.com
- Debian security tracker CVE-2026-99999 security-tracker.debian.org
- CloudLinux analysis of CVE-2026-99999 blog.cloudlinux.com
- Researcher write-up PwnEscape (pwn.ai) pwn.ai
- CIQ knowledge base: CVE-2026-99999 mitigation kb.ciq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:37.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
NVD references (11)
- https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a
- https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb
- https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822
- https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf
- https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956
- https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b
- https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326
- https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0
- https://pwn.ai/blog/pwnescape
- https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
- http://www.openwall.com/lists/oss-security/2026/10/15/5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.