CVE-2026-99999: IPv4 checksum validation in Linux kernel

CVE-2026-99999 affects the Linux kernel and involves a validation gap in IPv4 checksum handling. The flaw allows packets with malformed checksum metadata to reach the IPv4 stack without proper validation. When skb_checksum_help attempts to complete the checksum, it can corrupt the network header, leading to unpredictable behavior. All affected Linux systems face risks of network disruption and memory corruption.

The assigned CVSS score is 9.3, classified as critical in NVD data published on October 15, 2026. The vulnerability was discovered and reported by a researcher (Paulos) and independently reproduced by others. Current signals show discussions on X with 2 posts in the last 24 hours, though general attention remains moderate. Active exploitation in the wild is not confirmed.

Linux system administrators must prioritize kernel updates to versions that implement proper checksum validation as a defense-in-depth measure. Check with your system vendor for patch availability. In the interim, review network configuration and monitor checksum errors in system logs. The kernel maintainers have identified the need for more complete validation at packet input.