Cloudanix VulnDB

CVE-2026-99999

Critical · 9.3

CVSS

9.3

EPSS

0.3%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux kernel's network processing can let someone with access to the computer take full control of the machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient validation of checksum metadata in the IPv4 stack allows skb_checksum_help to corrupt the network header when processing malformed packets.

Why it matters to the business

Local attackers can achieve full system compromise on affected Linux kernels, leading to data breaches, service disruption, and potential ransomware deployment across enterprise server fleets.

How an attack unfolds

An attacker with local access crafts a packet containing invalid checksum metadata that reaches the IPv4 stack; when skb_checksum_help processes it, the network header is corrupted, enabling memory corruption primitives that PwnEscape has leveraged for privilege escalation.

How to fix it

Upgrade to the fixed kernel versions provided in RHSA-2026:87098: kernel 6.12.0-55.112.1.el10_0 (EL10), 4.18.0-477.176.1.el8_8 (EL8), 5.14.0-427.157.1.el9_4 (EL9), or 5.14.0-284.199.1.rt14.484.el9_2 (EL9 RT). Reboot after installation.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed releases listed in RHSA-2026:87098 and confirm the patch is present by checking the kernel source for the added checksum_start validation before skb_checksum_help.

Typical attack path

  1. Obtain local code execution on a target system running an affected kernel
  2. Craft and inject a packet with deliberately invalid checksum metadata into the network stack
  3. Trigger skb_checksum_help to process the malformed packet and corrupt the network header
  4. Exploit the resulting memory corruption to escalate privileges or execute arbitrary code

How to detect it

Review kernel logs and network stack traces for skb_checksum_help calls on packets with invalid checksum metadata; correlate with PwnEscape tooling indicators in process execution and memory dumps on systems that remain unpatched.

What your security team should do

  • Immediately apply the RHSA-2026:87098 updates to all Red Hat EL8/EL9/EL10 systems within the 8-day window since publication
  • Prioritize patching internet-facing and high-value servers first given the PwnEscape threat actor interest
  • Enable kernel lockdown and restrict local user access until patches are deployed
  • Monitor for post-patch regressions in network performance

The record

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities