{"id":"CVE-2026-99030","kind":"vulnerability","aliases":["CVE-2026-99030"],"related":[],"title":"Linux kernel: stale memory bytes can leak in outgoing ICMP and TX packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller's buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn't fill.  The checksum usually\nwon't match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn't.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().","summary":"When the kernel copies a packet with unreadable fragments, it returns only the linear part and leaves the rest of the destination buffer holding old memory contents. That buffer may then be sent on the wire as an ICMP error quote or a driver TX bounce buffer, so an attacker may receive leftover kernel memory.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","networking","package","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit \"net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\"; the sources do not list fixed versions.","status":"open","published_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:24+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:54:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit \"net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()\"; the sources do not list fixed versions.","reach":"network","title":"Linux kernel: stale memory bytes can leak in outgoing ICMP and TX packets","impact":"low","summary":"When the kernel copies a packet with unreadable fragments, it returns only the linear part and leaves the rest of the destination buffer holding old memory contents. That buffer may then be sent on the wire as an ICMP error quote or a driver TX bounce buffer, so an attacker may receive leftover kernel memory.","category":"package","nicknames":[],"who_cares":["linux-kernel","self-hosted","networking"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Leftover kernel memory contents leak in outgoing network packets","analyst_note":"Check the upstream kernel commit and NVD entry for affected version ranges, fixed versions and whether the trigger needs unreadable frags from a specific path.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running a Linux kernel with the affected skb_copy_and_csum_bits() code, particularly hosts that generate ICMP errors for packets with unreadable (for example zero-copy or page-fragment) frags or use drivers that take the skb_copy_and_csum_dev() bounce path. The sources do not say which kernel versions or configurations are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00064,"input_tokens":3525,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99030':16A,19A '0':117C 'anyth':220C 'attack':77B 'beforehand':176C 'bit':105C,111C 'bounc':73B,164C 'broken':235C 'buffer':50B,56B,74B,131C,142C,165C,173C,190C 'byte':5A,99C 'caller':129C,138C,236C 'carri':219C 'checksum':196C 'content':54B 'copi':31B,102C,108C,119C,139C,168C 'csum':104C,110C,170C 'cve':14A,17A 'data':202C 'destin':49B 'dev':171C 'didn':192C 'driver':71B,161C 'drop':210C 'either':214C 'error':67B,154C 'fill':194C 'follow':88C 'frag':114C 'fragment':36B 'get':183C 'go':147C 'hold':51B 'host':27B 'huge':242C 'icmp':10A,66B,153C 'kernel':2A,22B,30B,81B,86C 'leak':7A 'leav':44B,97C 'left':133C 'leftov':80B 'len':229C 'linear':41B,122C 'linux':1A,21B,85C 'linux-kernel':20B 'longer':218C 'match':200C 'may':57B,78B 'memori':4A,53B,82B,181C 'memset':243C 'must':237C 'negat':231C 'neither':172C 'net':93C 'network':23B 'offend':157C 'old':52B 'one':232C 'outgo':9A 'packag':24B 'packet':13A,33B,158C,212C 'part':42B,123C,187C 'posit':228C 'quot':68B,155C 'reach':112C 'receiv':79B,207C 'resolv':92C 'rest':46B,126C 'return':38B,116C 'self':26B 'self-host':25B 'sent':60B,184C 'shouldn':222C 'skb':101C,107C,167C 'skbuff':94C 'stale':3A,98C 'turn':239C 'tx':12A,72B,163C 'unread':35B,113C 'usual':197C,209C 'vulner':89C 'way':215C 'whatev':178C 'wire':63B,151C 'won':198C 'zero':175C,185C,225C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the affected skb_copy_and_csum_bits() code, particularly hosts that generate ICMP errors for packets with unreadable (for example zero-copy or page-fragment) frags or use drivers that take the skb_copy_and_csum_dev() bounce path. The sources do not say which kernel versions or configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99030","severity":null,"published_at":"2026-10-23T13:17:26+00:00","modified_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99030","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99030","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}