{"id":"CVE-2026-99999","summary":"ipv4: validate checksum_start before completing checksum","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.","modified":"2026-10-16T02:47:23.506047275Z","published":"2026-10-15T12:19:22.784Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99999.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"},{"type":"WEB","url":"https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99999.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99999"},{"type":"ARTICLE","url":"https://pwn.ai/blog/Pwnescape"},{"type":"ARTICLE","url":"https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f43798c27684ab925adde7d8acc34c78c6e50df8"},{"fixed":"a464d950f31c89565cbaae038cc60db04fe01956"},{"fixed":"0fab003ef4698e0628060a45a48f14b43ba2a40a"},{"fixed":"94524b7b32691de2e2ce162c04d6cbc9106e5cbf"},{"fixed":"a65f69e0f38ffbed1b128029e09097436416dc8b"},{"fixed":"32a8b0adaa18e52aaa0b246b5ffe683075354dbb"},{"fixed":"f3e835af6226f1dd12160cbd696081e9b6155de0"},{"fixed":"c3e33464746166264334641dc850a36eef7e6326"},{"fixed":"6785011f8b16abf40b1e9d8b2e332232b3e68822"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-99999.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.27"},{"fixed":"5.10.272"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.223"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.190"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.159"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.57"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-99999.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}