CVE-2026-99077
Description
A flaw was found in the Linux kernel's IPv4 User Datagram Protocol (UDP) implementation. When handling Internet Control Message Protocol (ICMP) error messages, routing exceptions were only recorded in the cache if the quoted UDP packet matched an existing active socket. An off-path remote attacker could exploit this side channel by sending forged ICMP packets and observing cache behavior, leading to information disclosure of ephemeral port numbers used by connected UDP sockets. Exposing these active port numbers can assist attackers in conducting subsequent network spoofing or traffic manipulation attacks.
Statement
This vulnerability is rated as Low severity on Red Hat Enterprise Linux because it represents an information-disclosure side channel that requires high attack complexity and precise timing to exploit, without directly enabling host compromise or denial of service. While Red Hat systems handle UDP traffic and process incoming ICMP error messages by default, an off-path attacker must accurately probe active, connected sockets while navigating routing cache noise. Even if ephemeral port numbers are uncovered, exploitation remains limited to facilitating blind spoofing against specific protocols, where standard defenses such as transaction ID randomization and DNSSEC further restrict overall impact.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 7.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality,Access Control
Technical Impact: Read Application Data; Bypass Protection Mechanism
Attackers could use knowledge of these internal operations to simplify or optimize their attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
