---
id: "CVE-2026-99030"
kind: "vulnerability"
aliases: ["CVE-2026-99030"]
title: "Linux kernel: stale memory bytes can leak in outgoing ICMP and TX packets"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux-kernel", "networking", "package", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-23T13:17:26+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99030", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99030", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: stale memory bytes can leak in outgoing ICMP and TX packets

When the kernel copies a packet with unreadable fragments, it returns only the linear part and leaves the rest of the destination buffer holding old memory contents. That buffer may then be sent on the wire as an ICMP error quote or a driver TX bounce buffer, so an attacker may receive leftover kernel memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream commit "net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()"; the sources do not list fixed versions.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99030
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99030

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
after copying only the linear part, and the rest of the caller's buffer
is left as it was.  The callers copy into a buffer that is about to go
out on the wire: an ICMP error quoting the offending packet, or a
driver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer
is zeroed beforehand, so whatever was in memory there gets sent.

Zero the part of the buffer we didn't fill.  The checksum usually
won't match the data any more, so the receiver will usually drop the
packet, but either way it no longer carries anything it shouldn't.
Only zero for a positive @len, a negative one from a broken caller must
not turn into a huge memset().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_