All vulnerabilities
CVE-2026-99999

Linux: ipv4: validate checksum_start before completing checksum

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0fab003ef4698e0628060a45a48f14b43ba2a40aAlso 94524b7b32691de2e2ce162c04d6cbc9106e5cbf, 32a8b0adaa18e52aaa0b246b5ffe683075354dbb and 1 moreCVE List
Published15 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0fab003ef4698e0628060a45a48f14b43ba2a40aLinuxCVE List
  • 94524b7b32691de2e2ce162c04d6cbc9106e5cbfLinuxCVE List
  • 32a8b0adaa18e52aaa0b246b5ffe683075354dbbLinuxCVE List
  • 6785011f8b16abf40b1e9d8b2e332232b3e68822LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 2

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksum_start before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.

This was discovered and reported by Paulos, and has been reporoduced by others independently since.

We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

Text from CVE List

Affected versions 18

  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before a464d950f31c89565cbaae038cc60db04fe01956CVE List
  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before 0fab003ef4698e0628060a45a48f14b43ba2a40aCVE List
  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before 94524b7b32691de2e2ce162c04d6cbc9106e5cbfCVE List
  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before a65f69e0f38ffbed1b128029e09097436416dc8bCVE List
  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before 32a8b0adaa18e52aaa0b246b5ffe683075354dbbCVE List
  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before f3e835af6226f1dd12160cbd696081e9b6155de0CVE List
  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before c3e33464746166264334641dc850a36eef7e6326CVE List
  • Linuxaffected: f43798c27684ab925adde7d8acc34c78c6e50df8 before 6785011f8b16abf40b1e9d8b2e332232b3e68822CVE List
  • Linuxaffected: 2.6.27CVE List
  • Linuxunaffected: all versions before 2.6.27CVE List
  • Linuxunaffected: 5.10.272 through 5.10.*CVE List
  • Linuxunaffected: 5.15.223 through 5.15.*CVE List
  • Linuxunaffected: 6.1.190 through 6.1.*CVE List
  • Linuxunaffected: 6.6.159 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 10