{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-99030", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.386Z", "datePublished": "2026-10-23T12:21:23.271Z", "dateUpdated": "2026-10-24T14:10:06.982Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:10:06.982Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller's buffer\nis left as it was. The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn't fill. The checksum usually\nwon't match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn't.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - A remote peer can send an IPv4/TCP segment with an IPOPT_RR length of 2 and payload into a devmem RX flow; ip_rcv() -> ip_rcv_finish_core() -> ip_rcv_options() -> icmp_send() -> icmp_glue_bits() reaches the patched skb_copy_and_csum_bits() while constructing ICMP_PARAMETERPROB.\nAC:L - With documented devmem header splitting and RX-queue binding active, the peer controls the invalid option and payload length, so the unreadable-fragment return and stale transmission occur deterministically; no race or uncontrollable condition is required.\nPR:N - ip_options_compile() emits ICMP_PARAMETERPROB before tcp_v4_rcv() performs TCP-state processing or any application authentication; neither this path nor skb_copy_and_csum_bits() checks a target credential or capability.\nUI:N - The peer's malformed segment alone drives ip_rcv_options() and the ICMP reply; an already-active devmem flow is service configuration, and no victim must respond, open data, or perform another action.\nS:U - The uninitialized ICMP transmit buffer and the prior skb-head contents it exposes are both managed by the same host kernel; the flaw crosses no VM, IOMMU, or sandbox security authority.\nC:H - skb_copy_and_csum_bits() copies only the linear headers and can leave roughly 500 bytes of a 548-byte IPv4 ICMP quote stale in an unzeroed alloc_skb() buffer; repeatable replies transmit prior skb-head contents, supporting substantial remote data harvesting.\nI:N - skb_copy_and_csum_bits() writes the copied header within the allocated destination and merely leaves its tail untouched; there is no out-of-bounds write, attacker-controlled kernel modification, or persistent state corruption.\nA:N - The vulnerable branch returns zero without faulting, looping, or exhausting resources; its incorrect checksum may cause the receiver to drop the ICMP reply, but it does not crash or degrade the target kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/skbuff.c" ], "versions": [ { "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231", "lessThan": "5f19b9cfff79508e8cb09be40d014cb0807f3854", "status": "affected", "versionType": "git" }, { "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231", "lessThan": "5551399751e2c9f31e4f3428040985a07e79d9c2", "status": "affected", "versionType": "git" }, { "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231", "lessThan": "39d1a6b601831237c6038b5e3ac8dbb883c1700a", "status": "affected", "versionType": "git" }, { "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231", "lessThan": "ab9414ed70bd783e902a85c350620dee269bcb2b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/skbuff.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854" }, { "url": "https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2" }, { "url": "https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a" }, { "url": "https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b" } ], "title": "net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", "x_generator": { "engine": "bippy-1.2.0" } } } }