Answer in brief
CVE-2026-99030 records a High severity (CVSS 7.5) vulnerability in net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=65249feb6b3df9e17bab5911ee56fa7b0971e231 <5f19b9cfff79508e8cb09be40d014cb0807f3854 || >=65249feb6b3df9e17bab5911ee56fa7b0971e231 <5551399751e2c9f31e4f3428040985a07e79d9c2 || >=65249feb6b3df9e17bab5911ee56fa7b0971e231 <39d1a6b601831237c6038b5e3ac8dbb883c1700a || >=65249feb6b3df9e17bab5911ee56fa7b0971e231 <ab9414ed70bd783e902a85c350620dee269bcb2b | 5f19b9cfff79508e8cb09be40d014cb0807f3854, 5551399751e2c9f31e4f3428040985a07e79d9c2, 39d1a6b601831237c6038b5e3ac8dbb883c1700a, ab9414ed70bd783e902a85c350620dee269bcb2b |
| Linux/Linuxgeneric | 6.12 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent. Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().
Quoted source text, attributed separately from HOL analysis.