Bug 2553429 (CVE-2026-99999)

Summary:	CVE-2026-99999 kernel: ipv4: validate checksum_start before completing checksum
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, cchiang, dpaolell, fche, jdelft, jupierce, lgarciaa, maaro, mbiarnes, mori, pasik, ppalepu, ppostler, prdhamdh, rhayakaw, rhel-process-autobot, sghai, sidsharm, stanislav.moravec, suppawar, varosim, vlaad, watson-tool-maintainers, xili
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-15 12:52:25 UTC

In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksum_start before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.

This was discovered and reported by Paulos, and has been reporoduced
by others independently since.

We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

Comment 1 gkamathe 2026-10-16 05:20:29 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox

Comment 4 Jon Orris 2026-10-20 11:59:01 UTC

This issue has been addressed in the following products:

  NVIDIA for RHEL 10

Via RHSA-2026:85928 https://access.redhat.com/errata/RHSA-2026:85928

Comment 5 Jon Orris 2026-10-20 18:58:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:85979 https://access.redhat.com/errata/RHSA-2026:85979

Comment 6 Jon Orris 2026-10-20 19:36:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:86089 https://access.redhat.com/errata/RHSA-2026:86089

Comment 7 Jon Orris 2026-10-20 20:31:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:86033 https://access.redhat.com/errata/RHSA-2026:86033

Comment 8 Jon Orris 2026-10-21 15:42:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:87086 https://access.redhat.com/errata/RHSA-2026:87086

Comment 9 Jon Orris 2026-10-21 16:18:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:87098 https://access.redhat.com/errata/RHSA-2026:87098

Comment 10 Jon Orris 2026-10-21 19:32:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:87091 https://access.redhat.com/errata/RHSA-2026:87091

Comment 11 Jon Orris 2026-10-21 20:04:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:87264 https://access.redhat.com/errata/RHSA-2026:87264

Comment 12 Jon Orris 2026-10-22 06:21:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:87822 https://access.redhat.com/errata/RHSA-2026:87822

Comment 13 Jon Orris 2026-10-22 06:48:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:87821 https://access.redhat.com/errata/RHSA-2026:87821

Comment 14 Jon Orris 2026-10-22 12:51:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:88204 https://access.redhat.com/errata/RHSA-2026:88204

Comment 15 Jon Orris 2026-10-22 13:18:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:88206 https://access.redhat.com/errata/RHSA-2026:88206

Comment 17 Jon Orris 2026-10-24 16:39:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:89082 https://access.redhat.com/errata/RHSA-2026:89082

Comment 18 Jon Orris 2026-10-24 16:48:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:89083 https://access.redhat.com/errata/RHSA-2026:89083

Comment 19 Jon Orris 2026-10-27 11:59:18 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.21

Via RHSA-2026:89232 https://access.redhat.com/errata/RHSA-2026:89232

Comment 20 Jon Orris 2026-10-27 11:59:47 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.20

Via RHSA-2026:89333 https://access.redhat.com/errata/RHSA-2026:89333

Comment 21 Jon Orris 2026-10-27 12:21:28 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:89651 https://access.redhat.com/errata/RHSA-2026:89651

Comment 22 Jon Orris 2026-10-27 14:09:44 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2026:89725 https://access.redhat.com/errata/RHSA-2026:89725

Comment 23 Jon Orris 2026-10-27 16:03:52 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2026:89838 https://access.redhat.com/errata/RHSA-2026:89838

Comment 24 Jon Orris 2026-10-27 17:58:28 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2026:90272 https://access.redhat.com/errata/RHSA-2026:90272

Comment 25 Jon Orris 2026-10-27 17:58:49 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2026:89714 https://access.redhat.com/errata/RHSA-2026:89714

Comment 26 Jon Orris 2026-10-27 20:15:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION

Via RHSA-2026:90933 https://access.redhat.com/errata/RHSA-2026:90933

Comment 27 Jon Orris 2026-10-27 22:03:47 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:89197 https://access.redhat.com/errata/RHSA-2026:89197