Admins must patch Linux to fix critical CVE-2026-99999 header corruption vulnerability

A flaw in the Linux kernel allows remote attackers to corrupt network headers by sending packets with invalid checksum information. This issue is tracked as CVE-2026-99999 and carries a critical severity rating of 9.3 on the Common Vulnerability Scoring System. The vulnerability exists because the kernel does not sufficiently validate certain packet metadata before processing it further. Attackers can exploit this gap to cause mischief within the network stack.

System administrators must ensure their systems are updated to versions that include the necessary validation checks. The affected software includes Linux kernel versions before the specific commits listed in the advisory. This includes older versions such as 2.6.27. The flaw was discovered by a researcher named Paulos and has since been reproduced independently by others. The National Vulnerability Database records this issue and its associated weaknesses.

In plain English

The Linux kernel manages how your computer communicates over networks. When data arrives, it is packaged into units called packets. Each packet has a header that contains routing and integrity information. One part of this header is the checksum, which helps verify that the data has not been corrupted during transmission. In this specific vulnerability, the kernel fails to properly check the metadata associated with the checksum before completing its own calculations.

If an attacker sends a packet with bad checksum metadata, the kernel processes it incorrectly. This incorrect processing can corrupt the network header itself. A corrupted header can lead to unpredictable behavior within the network stack, potentially allowing an attacker to disrupt services or cause other mischief. The kernel relies on these headers to route and handle data correctly. When the header is damaged, the system may behave unexpectedly.

The background

The vulnerability was discovered and reported by Paulos, according to the source material. Other researchers have independently reproduced the issue since the initial report. The problem lies in the ipv4 stack component of the Linux kernel. Specifically, the function responsible for helping with checksum calculations, known as skb_checksum_help, does not validate the checksum_start value before completing the checksum process.

This lack of validation allows packets with bad metadata to pass through unchecked. The developers note that they really should not allow such packets in at all. However, as a defense-in-depth measure, they have implemented a check before completing the checksum. This immediate fix addresses the most direct path of exploitation. A more complete validation at the input stage is forthcoming but requires more work. The affected versions are those before the specific commit hashes identified in the advisory.

What changes now

System administrators need to verify the kernel version running on their servers and devices. The vulnerability affects Linux kernels before the commits a464d950f31c89565cbaae038cc60db04fe01956, 0fab003ef4698e0628060a45a48f14b43ba2a40a, 94524b7b32691de2e2ce162c04d6cbc9106e5cbf, and a65f69e0f38ffbed1b128029e09097436416dc8b. Any system running a kernel version prior to these commits is potentially vulnerable.

Administrators should check their distribution’s security advisories for updated kernel packages that include the fix. The fix involves validating the checksum_start value before the kernel completes the checksum calculation. This validation prevents the corruption of the network header caused by bad metadata. Until a more complete input validation is implemented, this check serves as a defense-in-depth measure. Ensuring systems are patched reduces the risk of remote attackers exploiting this flaw.

Key terms explained

A checksum is a value used to verify data integrity. When data travels across a network, it can be altered by errors or attacks. The checksum helps the receiving system detect if the data has changed. If the calculated checksum does not match the one in the packet, the data is usually discarded. Metadata is data that describes other data.

In networking, packet headers contain metadata like source and destination addresses. This vulnerability involves metadata related to how the checksum is calculated. Defense in depth is a strategy of using multiple layers of security controls. If one layer fails, another layer provides protection. Here, the kernel adds a check before processing to catch bad packets that earlier checks might have missed.

What to do and how to stay safe: Linux kernel

• Check the kernel version on all systems to see if it matches the affected ranges listed in the advisory.
• Look for security updates from your Linux distribution that address CVE-2026-99999 and apply them promptly.
• Monitor network logs for unusual packet errors or unexpected traffic patterns that might indicate exploitation attempts.
• Review firewall rules to ensure that only necessary traffic is allowed into the network perimeter.

Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-99999?

It is a critical vulnerability in the Linux kernel that allows remote attackers to corrupt network headers via invalid checksum metadata.

Which Linux kernel versions are affected?

Versions before the specific commits a464d950f31c89565cbaae038cc60db04fe01956, 0fab003ef4698e0628060a45a48f14b43ba2a40a, 94524b7b32691de2e2ce162c04d6cbc9106e5cbf, and a65f69e0f38ffbed1b128029e09097436416dc8b, including 2.6.27, are affected.

How was this vulnerability discovered?

It was discovered and reported by Paulos and has been independently reproduced by other researchers since the initial report.