{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f19b9cfff79508e8cb09be40d014cb0807f3854",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "5551399751e2c9f31e4f3428040985a07e79d9c2",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "39d1a6b601831237c6038b5e3ac8dbb883c1700a",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "ab9414ed70bd783e902a85c350620dee269bcb2b",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller\u0027s buffer\nis left as it was.  The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver\u0027s TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn\u0027t fill.  The checksum usually\nwon\u0027t match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn\u0027t.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote peer can send an IPv4/TCP segment with an IPOPT_RR length of 2 and payload into a devmem RX flow; ip_rcv() -\u003e ip_rcv_finish_core() -\u003e ip_rcv_options() -\u003e icmp_send() -\u003e icmp_glue_bits() reaches the patched skb_copy_and_csum_bits() while constructing ICMP_PARAMETERPROB.\nAC:L - With documented devmem header splitting and RX-queue binding active, the peer controls the invalid option and payload length, so the unreadable-fragment return and stale transmission occur deterministically; no race or uncontrollable condition is required.\nPR:N - ip_options_compile() emits ICMP_PARAMETERPROB before tcp_v4_rcv() performs TCP-state processing or any application authentication; neither this path nor skb_copy_and_csum_bits() checks a target credential or capability.\nUI:N - The peer\u0027s malformed segment alone drives ip_rcv_options() and the ICMP reply; an already-active devmem flow is service configuration, and no victim must respond, open data, or perform another action.\nS:U - The uninitialized ICMP transmit buffer and the prior skb-head contents it exposes are both managed by the same host kernel; the flaw crosses no VM, IOMMU, or sandbox security authority.\nC:H - skb_copy_and_csum_bits() copies only the linear headers and can leave roughly 500 bytes of a 548-byte IPv4 ICMP quote stale in an unzeroed alloc_skb() buffer; repeatable replies transmit prior skb-head contents, supporting substantial remote data harvesting.\nI:N - skb_copy_and_csum_bits() writes the copied header within the allocated destination and merely leaves its tail untouched; there is no out-of-bounds write, attacker-controlled kernel modification, or persistent state corruption.\nA:N - The vulnerable branch returns zero without faulting, looping, or exhausting resources; its incorrect checksum may cause the receiver to drop the ICMP reply, but it does not crash or degrade the target kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:10:06.982Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854"
        },
        {
          "url": "https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b"
        }
      ],
      "title": "net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99030",
    "datePublished": "2026-10-23T12:21:23.271Z",
    "dateReserved": "2026-09-25T10:25:14.386Z",
    "dateUpdated": "2026-10-24T14:10:06.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}