Live › vulnerability › CVE-2026-99030
Go to dashboardWhen the kernel copies a packet with unreadable fragments, it returns only the linear part and leaves the rest of the destination buffer holding old memory contents. That buffer may then be sent on the wire as an ICMP error quote or a driver TX bounce buffer, so an attacker may receive leftover kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the affected skb_copy_and_csum_bits() code, particularly hosts that generate ICMP errors for packets with unreadable (for example zero-copy or page-fragment) frags or use drivers that take the skb_copy_and_csum_dev() bounce path. The sources do not say which kernel versions or configurations are exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent.
Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().
This page as .md · .json · in your agent: get_signal("CVE-2026-99030")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.