CRITICAL Introduced in 2.6.27
PwnEscape
CVE-2026-99999
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
02KernelScan AI Analysis
Risk summary
A local attacker with access to a virtual network interface (TUN/TAP, virtio_net) can craft packets with a malicious checksum start offset, causing the IPv4 stack to corrupt kernel memory when computing checksums. This leads to privilege escalation or kernel crash. Container and VM environments using virtual networking are primarily at risk.
Vulnerability analysis
The IPv4 stack failed to validate the skb->csum_start field before passing packets with CHECKSUM_PARTIAL to skb_checksum_help(). If csum_start points before the transport header (i.e., into the IP header or earlier), the checksum computation writes into the IP header, corrupting kernel memory. The fix adds a helper ip_check_csum_start() that rejects packets where csum_start is less than network_header + IP header length, and calls this check in all IPv4 output paths that invoke skb_checksum_help: IP fragmentation, bridge netfilter, netfilter queue, xt_CHECKSUM target, and IPsec output. An attacker needs CAP_NET_ADMIN (obtainable in a user namespace) to inject such packets via TUN/TAP or virtio_net interfaces, making container and VM workloads the primary exposure.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.27 | 5.10.272 | a464d950f31c |
| 5.15 | 2.6.27 | 5.15.223 | 0fab003ef469 |
| 6.1 | 2.6.27 | 6.1.190 | 94524b7b3269 |
| 6.12 | 2.6.27 | 6.12.113 | 32a8b0adaa18 |
| 6.18 | 2.6.27 | 6.18.57 | f3e835af6226 |
| 6.6 | 2.6.27 | 6.6.159 | a65f69e0f38f |
| 7.2 | 2.6.27 | 7.2.11 | c3e334647461 |
| mainline | 2.6.27 | 7.3-rc7 | 6785011f8b16 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |