CVE-2026-99064
cipso: adjust cached option offsets when removing CIPSO
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vectorThis vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | H | High (conditions required) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | H | High |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a seven-byte RR option, parsing records rr at offset 30. Removing CIPSO moves RR to offset 20, while the cached offset remains 30. Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes; the latter may interpret packet data as the option length and copy it into fixed-size option storage. Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and router_alert offsets when they follow CIPSO. cipso_len is the distance the first memmove() shifts those options. The later header move and network-header reset relocate the bytes and their offset base together.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) | 3.1 | 8.1 HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA / Linux | 3.1 | 8.1 HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: 89aa3619d141d6cfb6040a561aebb6d99d3e2285 … < b965977126a90e01825814c859ba4788691eddd3 affected: 89aa3619d141d6cfb6040a561aebb6d99d3e2285 … < 2200fe1d6148b78e1b8f00f4b2bd47760015077f affected: 89aa3619d141d6cfb6040a561aebb6d99d3e2285 … < 6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0 affected: 89aa3619d141d6cfb6040a561aebb6d99d3e2285 … < 6d25ffca055a77787c21a36b66c253f76239411b default: unaffected |
| Linux | Linux | affected: 6.10 unaffected: 0 … < 6.10 unaffected: 6.12.113 … <= 6.12.* unaffected: 6.18.57 … <= 6.18.* unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
cipso: adjust cached option offsets when removing CIPSO
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285, < b965977126a90e01825814c859ba4788691eddd3; < 2200fe1d6148b78e1b8f00f4b2bd47760015077f; < 6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0; < 6d25ffca055a77787c21a36b66c253f76239411b | b965977126a90e01825814c859ba4788691eddd3, 2200fe1d6148b78e1b8f00f4b2bd47760015077f, 6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0, 6d25ffca055a77787c21a36b66c253f76239411b | ||
| Linux | Kernel | >= 6.10.0, < 6.12.113; >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.11 | 6.12.113, 6.18.57, 7.2.11 |
Linux distribution status
References (7)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/2200fe1d6148b78e1b8f00f4b2bd47760015077f NVD, CNA, OSV
- https://git.kernel.org/stable/c/6d25ffca055a77787c21a36b66c253f76239411b NVD, CNA, OSV
- https://git.kernel.org/stable/c/6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0 NVD, CNA, OSV
- https://git.kernel.org/stable/c/b965977126a90e01825814c859ba4788691eddd3 NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99064.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-99064 OSV