CVE-2026-99999: ipv4: validate checksum_start before completing checksum

Critical · CVSS 9.3 (CVSS 3.1)EPSS 0.79%, 56th percentilePublished 2026-10-15 12:19 UTCUpdated 2026-10-24 14:17 UTCAssigner: Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Tracked companies

Amazon Web Services

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

Fly.io Platform Wide Rolling Host Reboots
2026-10-16 16:22 UTC · Major · names this CVE
“…elevated primary standby switchovers during this period. We As a mitigation measure for PwnEscape (Linux Kernel CVE-2026-99999), host restarts are continuing in phases across all regions. At this point, more than 90% of the fleet has been…”
Hetzner CVE-2026-99999 (PwnEscape)
2026-10-16 06:00 UTC · Minor · names this CVE
“CVE-2026-99999 (PwnEscape) Start: 2026-10-16T06:00:00+00:00 On Thursday, October 15, 2026, a security vulnerability in the Linux…”
Linode (Akamai) (PwnEscape) Guest-to-Host KVM Escape [CVE-2026-99999]
2026-10-15 17:27 UTC · No impact listed · names this CVE
“(PwnEscape) Guest-to-Host KVM Escape [CVE-2026-99999] Akamai has completed patching Compute hypervisors for the known vulnerabilities related to CVE-2026-99999, also…”

Affected vendors and products

Linux: Linux

References

All CVEs Markdown JSON