Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-99999 Details

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:9.3 CRITICALVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a	kernel.org
https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb	kernel.org
https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822	kernel.org
https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf	kernel.org
https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956	kernel.org
https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b	kernel.org
https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326	kernel.org
https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0	kernel.org
https://pwn.ai/blog/pwnescape	kernel.org
https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge	kernel.org
http://www.openwall.com/lists/oss-security/2026/10/15/5	CVE

see all 11 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-20	Improper Input Validation	CISA-ADP

Affected Products

No affected product data is available for this CVE.

Change History

5 change records found show changes

Date	Action	Recorded By
Oct 19, 2026	CVE Modified	CISA-ADP
Oct 19, 2026	CVE Modified	kernel.org
Oct 16, 2026	CVE Modified	CISA-ADP
Oct 15, 2026	CVE Modified	CVE
Oct 15, 2026	New CVE Received	kernel.org