Vulnerability-Lookup

GHSA-2M74-G73V-PV5C

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-24 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent.

Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-99030"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:26Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller\u0027s buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver\u0027s TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn\u0027t fill.  The checksum usually\nwon\u0027t match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn\u0027t.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().",
  "id": "GHSA-2m74-g73v-pv5c",
  "modified": "2026-10-24T15:32:50Z",
  "published": "2026-10-23T15:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99030"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-99030 (GCVE-0-2026-99030)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:21 – Updated: 2026-10-24 14:10

Title

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent. Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7056 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/5f19b9cfff79508e8…
https://git.kernel.org/stable/c/5551399751e2c9f31…
https://git.kernel.org/stable/c/39d1a6b601831237c…
https://git.kernel.org/stable/c/ab9414ed70bd783e9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 65249feb6b3df9e17bab5911ee56fa7b0971e231 , < 5f19b9cfff79508e8cb09be40d014cb0807f3854 (git) Affected: 65249feb6b3df9e17bab5911ee56fa7b0971e231 , < 5551399751e2c9f31e4f3428040985a07e79d9c2 (git) Affected: 65249feb6b3df9e17bab5911ee56fa7b0971e231 , < 39d1a6b601831237c6038b5e3ac8dbb883c1700a (git) Affected: 65249feb6b3df9e17bab5911ee56fa7b0971e231 , < ab9414ed70bd783e902a85c350620dee269bcb2b (git)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f19b9cfff79508e8cb09be40d014cb0807f3854",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "5551399751e2c9f31e4f3428040985a07e79d9c2",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "39d1a6b601831237c6038b5e3ac8dbb883c1700a",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "ab9414ed70bd783e902a85c350620dee269bcb2b",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller\u0027s buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver\u0027s TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn\u0027t fill.  The checksum usually\nwon\u0027t match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn\u0027t.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote peer can send an IPv4/TCP segment with an IPOPT_RR length of 2 and payload into a devmem RX flow; ip_rcv() -\u003e ip_rcv_finish_core() -\u003e ip_rcv_options() -\u003e icmp_send() -\u003e icmp_glue_bits() reaches the patched skb_copy_and_csum_bits() while constructing ICMP_PARAMETERPROB.\nAC:L - With documented devmem header splitting and RX-queue binding active, the peer controls the invalid option and payload length, so the unreadable-fragment return and stale transmission occur deterministically; no race or uncontrollable condition is required.\nPR:N - ip_options_compile() emits ICMP_PARAMETERPROB before tcp_v4_rcv() performs TCP-state processing or any application authentication; neither this path nor skb_copy_and_csum_bits() checks a target credential or capability.\nUI:N - The peer\u0027s malformed segment alone drives ip_rcv_options() and the ICMP reply; an already-active devmem flow is service configuration, and no victim must respond, open data, or perform another action.\nS:U - The uninitialized ICMP transmit buffer and the prior skb-head contents it exposes are both managed by the same host kernel; the flaw crosses no VM, IOMMU, or sandbox security authority.\nC:H - skb_copy_and_csum_bits() copies only the linear headers and can leave roughly 500 bytes of a 548-byte IPv4 ICMP quote stale in an unzeroed alloc_skb() buffer; repeatable replies transmit prior skb-head contents, supporting substantial remote data harvesting.\nI:N - skb_copy_and_csum_bits() writes the copied header within the allocated destination and merely leaves its tail untouched; there is no out-of-bounds write, attacker-controlled kernel modification, or persistent state corruption.\nA:N - The vulnerable branch returns zero without faulting, looping, or exhausting resources; its incorrect checksum may cause the receiver to drop the ICMP reply, but it does not crash or degrade the target kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:10:06.982Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854"
        },
        {
          "url": "https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b"
        }
      ],
      "title": "net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99030",
    "datePublished": "2026-10-23T12:21:23.271Z",
    "dateReserved": "2026-09-25T10:25:14.386Z",
    "dateUpdated": "2026-10-24T14:10:06.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted