CVE-2026-99064
Description
A flaw was found in the Linux kernel. When removing Commercial IP Security Option (CIPSO) attributes from a network packet, the kernel does not adjust the cached offsets of subsequent IP options. A remote attacker could exploit this vulnerability by sending specially crafted IPv4 packets, causing the system to read incorrect packet data and copy it into fixed-size memory buffers. This flaw can result in memory corruption or a Denial of Service (DoS).
Statement
This vulnerability is rated as having an Important severity because it enables unauthenticated remote attackers to trigger kernel memory corruption or cause a system crash through malformed network traffic, without requiring local privileges. Under default Red Hat Enterprise Linux configurations, labeled networking via CIPSO is not actively utilized unless multi-level security (MLS) or explicit NetLabel packet tagging policies are configured. However, systems receiving or forwarding IPv4 packets carrying CIPSO attributes alongside additional options remain exposed to offset desynchronization during option stripping, elevating the potential blast radius to kernel compromise or host instability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
