ipv4: validate checksum_start before completing checksum

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• Debian:12 linux6.1.106-1, 6.1.106-2, 6.1.106-3
• Debian:13 linux6.12.100-1, 6.12.101-1, 6.12.105-1
• Debian:14 linux6.12.100-1, 6.12.101-1, 6.12.105-1
• Linux Kernel2.6.27 → 5.10.272; 5.11.0 → 5.15.223; 5.16.0 → 6.1.190
• linux kernelversion unspecified
• package unmanagedversion unspecified
• vendor Linuxversion unspecified
• vendor Linux Linuxversion unspecified

How to fix CVE-2026-99999

• Recommended remediation

  A patch or advisory reference is linked. Open the original publisher for availability by product version.

• Official advisories

  • AWS Security Bulletins · aws.amazon.com
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • EUVD · euvd.enisa.europa.eu
  • Linux Kernel CVE · git.kernel.org
  • NIST NVD · nvd.nist.gov

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org
• Repository · git.kernel.org

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2026 · NIST NVD

   Detected

   In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such

2. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

   Updated

   In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such

3. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

   Updated

   In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such

4. Oct 15, 2026 · NIST NVD

   Updated

   In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such

5. Oct 17, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   Kernel fixed in 5.10.272; Kernel fixed in 5.15.223; Kernel fixed in 6.1.190; Kernel fixed in 6.6.159

6. Oct 17, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   Kernel fixed in 5.10.272; 5.11.0

7. Oct 17, 2026 · OpenSSF OSV / OSV Scanner

   Updated

   In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such

8. Oct 17, 2026 · EUVD

   Updated

   In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such

Sources

• AWS Security BulletinsVendor advisoryCVE-2026-99999

  Bulletin ID: 2026-137-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/15/2026 10:30 AM PDT Description: AWS is aware of an issue in the Linux kernel's virtio-net/TAP networking path (CVE-2026-99999) that affects KVM-based hypervisors running unpat

  aws.amazon.com
• CVE.orgVulnerability recordCVE-2026-99999

  In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was d

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-99999

  30-day exploitation probability 21.0%

  first.org
• EUVDVulnerability recordEUVD-2026-102044

  In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was d

  euvd.enisa.europa.eu
• Linux Kernel CVEVendor advisoryCVE-2026-99999

  From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network

  git.kernel.org
• NIST NVDVulnerability recordCVE-2026-99999

  In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This wa

  nvd.nist.gov
• Openwall OSS SecurityThreat researchCVE-2026-99999

  Research mention from Openwall OSS Security. Not confirmation of exploitation.

  openwall.com
• OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-99999

  ipv4: validate checksum_start before completing checksum

  osv.dev
• OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-99999
  osv.dev
• ProxmoxVendor advisoryCVE-2026-99999

  After the news of a possible KVM escape made the rounds at the start of the month, we finally got some more information and a patch to fix it: https://www.cve.org/CVERecord?id=CVE-2026-99999 https://pwn.ai/blog/pwnescape https://github.com/torvalds/linux/commit/6785011f8b16abf40b

  forum.proxmox.com
• Snyk Vulnerability DatabasePackage advisorySNYK-UNMANAGED-TORVALDSLINUX-20994007

  Denial of Service (DoS)

  security.snyk.io

References

• WEB · openwall.com
• EUVD record · euvd.enisa.europa.eu
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• Reference · git.kernel.org
• ADVISORY · security-tracker.debian.org

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.