{"api_version":"1","generated_at":"2026-11-04T05:40:54+00:00","cve":"CVE-2026-99030","urls":{"html":"https://cve.report/CVE-2026-99030","api":"https://cve.report/api/cve/CVE-2026-99030.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99030","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99030"},"summary":{"title":"net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller's buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn't fill.  The checksum usually\nwon't match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn't.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 13:17:26","updated_at":"2026-10-24 14:16:53"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2","name":"https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b","name":"https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a","name":"https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854","name":"https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99030","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99030","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 65249feb6b3df9e17bab5911ee56fa7b0971e231 5f19b9cfff79508e8cb09be40d014cb0807f3854 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 65249feb6b3df9e17bab5911ee56fa7b0971e231 5551399751e2c9f31e4f3428040985a07e79d9c2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 65249feb6b3df9e17bab5911ee56fa7b0971e231 39d1a6b601831237c6038b5e3ac8dbb883c1700a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 65249feb6b3df9e17bab5911ee56fa7b0971e231 ab9414ed70bd783e902a85c350620dee269bcb2b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.113 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.11 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5f19b9cfff79508e8cb09be40d014cb0807f3854","status":"affected","version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","versionType":"git"},{"lessThan":"5551399751e2c9f31e4f3428040985a07e79d9c2","status":"affected","version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","versionType":"git"},{"lessThan":"39d1a6b601831237c6038b5e3ac8dbb883c1700a","status":"affected","version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","versionType":"git"},{"lessThan":"ab9414ed70bd783e902a85c350620dee269bcb2b","status":"affected","version":"65249feb6b3df9e17bab5911ee56fa7b0971e231","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.113","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.11","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller's buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn't fill.  The checksum usually\nwon't match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn't.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset()."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - A remote peer can send an IPv4/TCP segment with an IPOPT_RR length of 2 and payload into a devmem RX flow; ip_rcv() -> ip_rcv_finish_core() -> ip_rcv_options() -> icmp_send() -> icmp_glue_bits() reaches the patched skb_copy_and_csum_bits() while constructing ICMP_PARAMETERPROB.\nAC:L - With documented devmem header splitting and RX-queue binding active, the peer controls the invalid option and payload length, so the unreadable-fragment return and stale transmission occur deterministically; no race or uncontrollable condition is required.\nPR:N - ip_options_compile() emits ICMP_PARAMETERPROB before tcp_v4_rcv() performs TCP-state processing or any application authentication; neither this path nor skb_copy_and_csum_bits() checks a target credential or capability.\nUI:N - The peer's malformed segment alone drives ip_rcv_options() and the ICMP reply; an already-active devmem flow is service configuration, and no victim must respond, open data, or perform another action.\nS:U - The uninitialized ICMP transmit buffer and the prior skb-head contents it exposes are both managed by the same host kernel; the flaw crosses no VM, IOMMU, or sandbox security authority.\nC:H - skb_copy_and_csum_bits() copies only the linear headers and can leave roughly 500 bytes of a 548-byte IPv4 ICMP quote stale in an unzeroed alloc_skb() buffer; repeatable replies transmit prior skb-head contents, supporting substantial remote data harvesting.\nI:N - skb_copy_and_csum_bits() writes the copied header within the allocated destination and merely leaves its tail untouched; there is no out-of-bounds write, attacker-controlled kernel modification, or persistent state corruption.\nA:N - The vulnerable branch returns zero without faulting, looping, or exhausting resources; its incorrect checksum may cause the receiver to drop the ICMP reply, but it does not crash or degrade the target kernel."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:10:06.982Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854"},{"url":"https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2"},{"url":"https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a"},{"url":"https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b"}],"title":"net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99030","datePublished":"2026-10-23T12:21:23.271Z","dateReserved":"2026-09-25T10:25:14.386Z","dateUpdated":"2026-10-24T14:10:06.982Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 13:17:26","lastModifiedDate":"2026-10-24 14:16:53","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99030","Ordinal":"1","Title":"net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()","CVE":"CVE-2026-99030","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99030","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller's buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn't fill.  The checksum usually\nwon't match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn't.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().","Type":"Description","Title":"net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()"}]}}}