ipv4: udp: Create exceptions before socket matching

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99077
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-23 13:17:31 UTC
Updated2026-10-30 13:21:43 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the FNHE cache in order to discover the ephemeral port used by a connected UDP socket. Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the FNHE cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating a FNHE, even before trying to find a matching socket. Do that by calling ipv4_update_pmtu() and ipv4_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in a FNHE being created or updated in the cache that the attacker can observe. Pass an oif of 0, in a similar fashion to icmp_err(). This is also the oif used by the socket path for sockets that are not bound to a device. Note that this does not allow attackers to create FNHEs that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMP error that quotes an ICMP Echo Reply or one that quotes a UDP source port that matches a wildcard socket. Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ipv4_sk_update_pmtu() / ipv4_sk_redirect(). When the two resolve to different nexthops, it also results in two exceptions being created for the same destination IP. One in the FNHE cache of the nexthop resolved by the no socket helpers and another in the FNHE cache of the nexthop used by the socket.

Risk And Classification

Primary CVSS: v3.1 7.4 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.004310000 probability, percentile 0.373880000 (date 2026-11-01)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
3.1CNADECLARED7.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 e8f211a37396f1684af9ac81b3fc53538eb9c2f7 git Not specified
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 9f97b01ee799bdf57d9183623f3987c8bbfd4f6f git Not specified
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 e0cd4942831d4ef8f6d4b90b0d3510460fdfbceb git Not specified
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 0cf0ff2f728f2a1434c56c0bcf267fe230abf124 git Not specified
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 3b92e4349c6b0dd1e05d5f0483e71ef37691b1c3 git Not specified
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 ecd7ead4bf05e221e90f18a29aec570a50fd1592 git Not specified
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 be4fd05398f2b5e42029be70ee875fc749b8ce3a git Not specified
CNA Linux Linux affected 4895c771c7f006b4b90f9d6b1d2210939ba57b38 4c3499f79f8c7e8561266bcc220a18538cec0458 git Not specified
CNA Linux Linux affected 3.6 Not specified
CNA Linux Linux unaffected 3.6 semver Not specified
CNA Linux Linux unaffected 5.10.273 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.224 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.59 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.11 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/e8f211a37396f1684af9ac81b3fc53538eb9c2f7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3b92e4349c6b0dd1e05d5f0483e71ef37691b1c3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0cf0ff2f728f2a1434c56c0bcf267fe230abf124 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9f97b01ee799bdf57d9183623f3987c8bbfd4f6f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e0cd4942831d4ef8f6d4b90b0d3510460fdfbceb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ecd7ead4bf05e221e90f18a29aec570a50fd1592 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report