CVE-2026-99999 ipv4: validate checksum_start before completing checksum
A flaw in the Linux kernel IPv4 stack allows corrupting network headers via bad checksum metadata, potentially leading to memory corruption or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-99999?
CVE-2026-99999 is a critical memory corruption vulnerability in Linux, published on 15 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv4: validate checksum_start before completing checksum
If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.
This was discovered and reported by Paulos, and has been reporoduced by others independently since.
We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum.
A more complete validation at input is forthcoming, but needs more work.
Weakness: CWE-20
Which versions are affected by CVE-2026-99999?
How do I fix CVE-2026-99999?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-99999 being exploited?
There is no known exploitation of CVE-2026-99999 in the wild and no public exploit code.
Public exploit code: 14 proofs of concept on GitHub.
Sources
Also known as AZL-108243, BELL-CVE-2026-99999, DEBIAN-CVE-2026-99999, UBUNTU-CVE-2026-99999.