Cloudanix VulnDB

CVE-2026-99077

High · 7.4

CVSS

7.4

EPSS

0.4%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel issue lets remote attackers figure out secret port numbers used by some network connections, which could help them target those connections more effectively.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits off-path attackers to perform side-channel attacks against the IPv4 FIB nexthop exception (FNHE) cache by sending ICMP Fragmentation Needed or Redirect messages that quote UDP packets; because exceptions are created only after successful socket matching, the absence or presence of cache entries reveals information about ephemeral ports used by connected UDP sockets.

Why it matters to the business

Attackers may discover UDP port numbers used by applications, enabling targeted follow-on attacks against network services and reducing the effectiveness of port randomization defenses on Linux systems.

How an attack unfolds

An off-path attacker sends crafted ICMP error messages quoting UDP packets toward a target; by observing whether FNHE cache entries are created or updated (bypassing prior mitigations), the attacker infers the ephemeral port of a connected UDP socket. The described commit forces exception creation before socket lookup so every guess produces an observable cache change.

How to fix it

Apply the upstream Linux kernel fix that calls ipv4_update_pmtu() and ipv4_redirect() with oif=0 before attempting socket matching; deploy a kernel containing commit 6457378fe796 and the referenced change once released in the relevant distribution.

How to confirm the fix worked

Inspect kernel source for the new early invocation of ipv4_update_pmtu/ipv4_redirect in icmp_socket_deliver or equivalent paths; verify that ICMP errors quoting non-socket UDP packets now create FNHE entries.

Typical attack path

  1. Craft and send ICMP Fragmentation Needed or Redirect packets quoting UDP datagrams
  2. Monitor FNHE cache behavior or hash bucket occupancy for changes
  3. Correlate cache observations with guesses to identify the target socket's ephemeral port
  4. Use discovered port for subsequent targeted attacks

How to detect it

Examine kernel logs and netlink route monitoring for unexpected FNHE cache insertions triggered by ICMP messages; correlate with network flow data showing high volumes of ICMP errors quoting UDP traffic from untrusted sources.

What your security team should do

  • Expedite deployment of patched kernels on all systems handling UDP traffic
  • Review and harden UDP-based services that rely on ephemeral port secrecy
  • Increase logging of ICMP error messages and FNHE cache modifications for anomaly detection

The record

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the FNHE cache in order to discover the ephemeral port used by a connected UDP socket. Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the FNHE cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating a FNHE, even before trying to find a matching socket. Do that by calling ipv4_update_pmtu() and ipv4_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in a FNHE being created or updated in the cache that the attacker can observe. Pass an oif of 0, in a similar fashion to icmp_err(). This is also the oif used by the socket path for sockets that are not bound to a device. Note that this does not allow attackers to create FNHEs that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMP error that quotes an ICMP Echo Reply or one that quotes a UDP source port that matches a wildcard socket. Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ipv4_sk_update_pmtu() / ipv4_sk_redirect(). When the two resolve to different nexthops, it also results in two exceptions being created for the same destination IP. One in the FNHE cache of the nexthop resolved by the no socket helpers and another in the FNHE cache of the nexthop used by the socket.

Affected packages

Ecosystem Package Introduced Fixed