CVE-2026-99999: ipv4: validate checksum_start before completing checksum
In the Linux kernel, the following vulnerability has been resolved:
ipv4: validate checksumstart before completing checksum
If a packet with bad checksum metadata gets into the ipv4 stack, skbchecksumhelp can corrupt the network header and cause a bunch of mischief.
This was discovered and reported by Paulos, and has been reporoduced by others independently since.
We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum.
A more complete validation at input is forthcoming, but needs more work.
Affected Software
Event History
Frequently Asked Questions
What is required to trigger this issue?
A packet with invalid checksum metadata must reach the IPv4 stack. The vulnerable checksum-completion path can then corrupt the network header.
What impact can successful triggering have?
Network-header corruption can lead to further unspecified harmful behavior. The supplied severity vector rates confidentiality, integrity, and availability impact as high, with scope changed.
Is an input-side validation fix available?
The described resolution adds a defense-in-depth check before checksum completion. The description states that more complete validation at packet input is still forthcoming and requires additional work.
How can I identify a kernel containing the referenced fix?
Review the kernel source or vendor update documentation for the referenced stable commits: a464d950f31c89565cbaae038cc60db04fe01956, 0fab003ef4698e0628060a45a48f14b43ba2a40a, or 94524b7b32691de2e2ce162c04d6cbc9106e5cbf. No affected or fixed kernel version numbers are provided.