CVE-2026-99999: Linux Kernel IPv4 DoS Vulnerability

CVE-2026-99999 Overview

CVE-2026-99999 is a Linux kernel vulnerability in the IPv4 networking stack. The flaw occurs when a packet carrying malformed checksum metadata reaches the IPv4 stack and is processed by skb_checksum_help. The function fails to validate checksum_start before completing the checksum, allowing corruption of the network header. This corruption can lead to downstream memory and protocol mischief within kernel networking paths. The vulnerability is categorized as improper input validation [CWE-20] and has been reproduced independently after the initial report. Related research was published through the Pwn.ai blog on Pwnescape and the Vercel $1M Sandbox Challenge findings.

Critical Impact
A local attacker can trigger kernel memory corruption through crafted packets with invalid checksum metadata, enabling privilege escalation or sandbox escape.

Affected Products

Linux kernel IPv4 networking stack
Distributions shipping unpatched kernel versions prior to the referenced stable commits
Container and sandbox runtimes relying on affected kernel versions

Discovery Timeline

2026-10-15 - CVE-2026-99999 published to the National Vulnerability Database (NVD)
2026-10-15 - Public discussion opened on the Openwall oss-security list
2026-10-19 - Last updated in the NVD database

Technical Details for CVE-2026-99999

Vulnerability Analysis

The vulnerability resides in the IPv4 receive path where skb_checksum_help completes a software checksum on a socket buffer (skb). When the kernel processes a packet whose checksum metadata is inconsistent with the actual skb layout, the function proceeds without verifying that checksum_start points inside the valid data region. The result is a write operation that lands outside the intended network header boundary. This write corrupts adjacent memory used by other networking state, producing cascading failures or exploitable primitives. The fix adds a defence-in-depth check that validates checksum_start before completing the checksum. According to the commit messages, upstream maintainers acknowledge that a more complete validation at packet input is still forthcoming.

Root Cause

The root cause is missing input validation [CWE-20] on skb metadata fields. The kernel trusts the checksum_start offset supplied with the packet without confirming it falls within the skb's linear data area. Attackers that can influence skb metadata, for example through virtualized network interfaces, container networking, or crafted raw sockets, can introduce packets that drive the function into writing to attacker-controlled offsets.

Attack Vector

Exploitation requires local access to a network ingress path that forwards attacker-controlled checksum metadata into the IPv4 stack. Public research references, including the Pwn.ai Pwnescape write-up and the Vercel sandbox challenge findings, describe scenarios where the flaw contributes to container and sandbox escapes. The vulnerability is reachable without authentication once an attacker has code execution within a sandboxed context that can emit crafted packets.

// No verified exploit code published. See upstream commits for the corrective
// validation added to skb_checksum_help, including the kernel stable commits
// 0fab003ef, 32a8b0aa, 6785011f, 94524b7b, a464d950, a65f69e0, c3e33464, f3e835af.

Detection Methods for CVE-2026-99999

Indicators of Compromise

Unexpected kernel oops, panics, or warnings originating in skb_checksum_help or neighboring IPv4 receive functions.
Container or sandbox workloads emitting malformed IPv4 packets with inconsistent checksum offsets.
Sudden loss of network connectivity on a host coinciding with kernel log entries referencing checksum operations.

Detection Strategies

Monitor dmesg and /var/log/kern.log for stack traces that reference skb_checksum_help, csum_partial, or IPv4 receive paths.
Alert on unprivileged processes repeatedly invoking AF_PACKET or raw socket operations with abnormal checksum metadata.
Correlate kernel warnings with container runtime events to identify sandbox tenants attempting exploitation.

Monitoring Recommendations

Centralize kernel logs from all Linux hosts, including container nodes, into a telemetry pipeline for retention and analysis.
Baseline normal rates of networking subsystem warnings and alert on deviations.
Track kernel version inventory across the fleet to confirm patch coverage against the upstream stable commits.

How to Mitigate CVE-2026-99999

Immediate Actions Required

Apply the upstream kernel fix referenced by the stable commits listed in the vendor advisories.
Prioritize patching hosts that run multi-tenant workloads, containers, or sandboxed code execution services.
Restrict access to raw socket and AF_PACKET capabilities for untrusted workloads.

Patch Information

The vulnerability is fixed in the Linux stable tree by commits 0fab003ef, 32a8b0aa, 6785011f, 94524b7b, a464d950, a65f69e0, c3e33464, and f3e835af. Rebuild and reboot into a kernel that includes the corresponding backport for your distribution.

Workarounds

Drop the CAP_NET_RAW capability from containers and sandboxed workloads that do not require it.
Enforce seccomp profiles that block raw socket creation for untrusted tenants.
Where feasible, offload checksum validation to trusted network hardware and discard packets with bad checksum metadata at ingress.

bash

# Remove CAP_NET_RAW from a running container runtime configuration
docker run --cap-drop=NET_RAW --security-opt seccomp=restricted.json <image>

# Verify running kernel includes the fix
uname -r