CVE-2026-99999 (GCVE-0-2026-99999)
Vulnerability from cvelistv5
Published
2026-10-15 12:19
Modified
2026-10-24 14:17
Severity ?
9.3 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
References
Impacted products
Vendor Product Version
Linux Linux Version: f43798c27684ab925adde7d8acc34c78c6e50df8
Version: f43798c27684ab925adde7d8acc34c78c6e50df8
Version: f43798c27684ab925adde7d8acc34c78c6e50df8
Version: f43798c27684ab925adde7d8acc34c78c6e50df8
Version: f43798c27684ab925adde7d8acc34c78c6e50df8
Version: f43798c27684ab925adde7d8acc34c78c6e50df8
Version: f43798c27684ab925adde7d8acc34c78c6e50df8
Version: f43798c27684ab925adde7d8acc34c78c6e50df8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:07:24.590Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-99999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:03.519458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:28.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a464d950f31c89565cbaae038cc60db04fe01956",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "c3e33464746166264334641dc850a36eef7e6326",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.272",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.223",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.190",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.159",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb\u0027s logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:17:15.740Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"
        },
        {
          "url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"
        },
        {
          "url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"
        },
        {
          "url": "https://pwn.ai/blog/pwnescape"
        },
        {
          "url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"
        }
      ],
      "title": "ipv4: validate checksum_start before completing checksum",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99999",
    "datePublished": "2026-10-15T12:19:22.784Z",
    "dateReserved": "2026-09-25T10:25:14.451Z",
    "dateUpdated": "2026-10-24T14:17:15.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/10/15/5\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-10-15T22:07:24.590Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-99999\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:49:03.519458Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:49:10.811Z\"}}], \"cna\": {\"title\": \"ipv4: validate checksum_start before completing checksum\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb\u0027s logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"a464d950f31c89565cbaae038cc60db04fe01956\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"0fab003ef4698e0628060a45a48f14b43ba2a40a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"94524b7b32691de2e2ce162c04d6cbc9106e5cbf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"a65f69e0f38ffbed1b128029e09097436416dc8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"32a8b0adaa18e52aaa0b246b5ffe683075354dbb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"f3e835af6226f1dd12160cbd696081e9b6155de0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"c3e33464746166264334641dc850a36eef7e6326\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f43798c27684ab925adde7d8acc34c78c6e50df8\", \"lessThan\": \"6785011f8b16abf40b1e9d8b2e332232b3e68822\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/ip.h\", \"net/bridge/netfilter/nf_conntrack_bridge.c\", \"net/ipv4/ip_output.c\", \"net/netfilter/nfnetlink_queue.c\", \"net/netfilter/xt_CHECKSUM.c\", \"net/xfrm/xfrm_output.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.27\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.27\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.272\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.223\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.190\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/ip.h\", \"net/bridge/netfilter/nf_conntrack_bridge.c\", \"net/ipv4/ip_output.c\", \"net/netfilter/nfnetlink_queue.c\", \"net/netfilter/xt_CHECKSUM.c\", \"net/xfrm/xfrm_output.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956\"}, {\"url\": \"https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a\"}, {\"url\": \"https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf\"}, {\"url\": \"https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b\"}, {\"url\": \"https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb\"}, {\"url\": \"https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0\"}, {\"url\": \"https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326\"}, {\"url\": \"https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822\"}, {\"url\": \"https://pwn.ai/blog/pwnescape\"}, {\"url\": \"https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv4: validate checksum_start before completing checksum\\n\\nIf a packet with bad checksum metadata gets into the ipv4 stack,\\nskb_checksum_help can corrupt the network header and cause a bunch of\\nmischief.\\n\\nThis was discovered and reported by Paulos, and has been reporoduced\\nby others independently since.\\n\\nWe really shouldn\u0027t allow such packets in, but as a defence\\nin depth measure, let\u0027s also check before we complete the checksum.\\n\\nA more complete validation at input is forthcoming, but needs more work.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.272\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.223\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.190\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.159\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.113\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.57\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.11\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"2.6.27\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-24T14:17:15.740Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-99999\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-24T14:17:15.740Z\", \"dateReserved\": \"2026-09-25T10:25:14.451Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-10-15T12:19:22.784Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.