Cloudanix VulnDB

CVE-2026-99076

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A recent Linux kernel problem with IPv6 network messages could let outside attackers guess which communication ports an application is secretly using.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits off-path attackers to discover ephemeral ports of connected UDP sockets via side-channel observation of the IPv6 exception cache, because ICMPv6 Packet Too Big and Redirect messages only create cache exceptions after successful socket matching rather than unconditionally.

Why it matters to the business

Attackers may infer internal port usage on Linux systems handling IPv6 UDP traffic, potentially enabling reconnaissance that supports follow-on attacks; the issue is recent with low exploit probability and no known campaigns, limiting immediate operational risk but requiring prompt kernel updates once available.

How an attack unfolds

An off-path attacker sends ICMPv6 error messages that quote UDP packets, observes whether exceptions appear in the exception cache via timing or hash behavior, and infers the target socket's ephemeral port; prior mitigations for cache predictability can be bypassed, and the flaw forces exceptions on every guess regardless of socket match.

How to fix it

Apply the upstream Linux kernel fix that calls ip6_update_pmtu() and ip6_redirect() before socket matching so that exceptions are always created; upgrade to the patched kernel version containing commit 4785305c05b2 and a00df2caffed when released in your distribution.

How to confirm the fix worked

Confirm the kernel source contains the change that invokes the no-socket helpers for ICMPv6 errors before attempting socket lookup, and test that both matched and unmatched UDP cases now create exceptions for quoted ICMPv6 messages.

Typical attack path

  1. Craft and send ICMPv6 Packet Too Big or Redirect messages quoting UDP datagrams from an off-path position
  2. Probe or monitor the IPv6 exception cache for new or updated entries triggered by the messages
  3. Analyze cache behavior and hash collisions to deduce the ephemeral port of the victim UDP socket
  4. Use discovered port information to facilitate further targeted attacks

How to detect it

Examine kernel routing and exception cache logs for unexpected IPv6 route updates or multiple exceptions created from ICMPv6 messages that quote UDP traffic; correlate with network flows showing unsolicited ICMPv6 errors directed at UDP ports.

What your security team should do

  • Prioritize kernel updates addressing this IPv6 UDP exception cache issue within normal patch cycles given low EPSS and absence from KEV
  • Review IPv6 UDP socket configurations and limit exposure to external ICMPv6 traffic where feasible
  • Monitor upstream kernel changelogs and distribution advisories for the exact fixed version
  • Validate that network monitoring covers IPv6 ICMP error handling paths

The record

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the exception cache in order to discover the ephemeral port used by a connected UDP socket. Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and commit a00df2caffed ("ipv6: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the exception cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating an exception, even before trying to find a matching socket. Do that by calling ip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in an exception being created or updated in the cache that the attacker can observe. Pass the ifindex of the ingress device and the default uid, in a similar fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any nexthop in ip6_redirect_nh_match() and no exception would be created in response to a Redirect Message. Note that this does not allow attackers to create exceptions that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMPv6 error that quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that matches a wildcard socket. Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ip6_sk_update_pmtu() / ip6_sk_redirect(). When the two resolve to different nexthops, it also results in two exceptions being created for the same destination IP. One in the exception cache of the nexthop resolved by the no socket helpers and another in the exception cache of the nexthop used by the socket.

Affected packages

Ecosystem Package Introduced Fixed