CVE-2026-99030
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Oct 23, 2026
CISA due date
—
Cloudanix analysis
A kernel networking bug can accidentally include leftover pieces of internal memory in certain error or outgoing network messages.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
skb_copy_and_csum_bits() returns early on unreadable frags after copying only the linear portion, leaving the remainder of the destination buffer (ICMP error payload or driver TX bounce buffer) containing whatever bytes were previously present in memory instead of zeroed data.
Why it matters to the business
Sensitive kernel memory contents may be transmitted in outbound network packets, creating a risk of unintended data exposure to remote observers.
How an attack unfolds
An attacker sends crafted network traffic that causes the kernel to invoke skb_copy_and_csum_bits() on an skb whose frags cannot be read, triggering the early return path; the caller then transmits the partially filled buffer containing prior memory contents inside an ICMP error or TX frame.
How to fix it
Apply the upstream kernel commit that zeros the unfilled portion of the destination buffer before the function returns; rebuild and deploy updated kernels to all affected systems.
How to confirm the fix worked
Confirm the presence of the zeroing logic in skb_copy_and_csum_bits() source or verify that the running kernel contains the fix via version string or module checksum comparison.
Typical attack path
- Send packets designed to trigger skb_copy_and_csum_bits() with unreadable frags
- Force the kernel to generate an ICMP error response or driver TX bounce buffer
- Receive the resulting packet containing residual memory bytes from the kernel heap or stack
How to detect it
Inspect network captures or host logs for ICMP error packets or driver TX frames whose payload lengths exceed the expected copied data size or contain unexpected non-zero patterns after the linear portion; correlate with processes generating such packets.
What your security team should do
- Prioritize kernel updates on all systems that perform packet forwarding, ICMP generation, or use network drivers calling skb_copy_and_csum_dev()
- Monitor upstream stable and distribution kernel releases for the backported patch
- Review network egress filtering to limit exposure of unexpected outbound traffic
The record
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent. Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|