News › security
By The Linux Camp News, October 16, 2026
The October 15 updates add validation before IPv4 checksum completion. The official CVE record describes a guest-to-host attack through virtual-network metadata, not an Internet receive path.
Linux's October 15, 2026 stable-kernel update wave includes a fix for CVE-2026-99999, an IPv4 checksum-metadata vulnerability. LWN reports that all seven releases contain the fix: 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272. These are upstream fixed-release reference points as retrieved on October 16, not distribution package-version verdicts. 1 5 3
Checksum offload lets the networking stack ask a device to finish a packet's checksum. Its metadata specifies both where calculation begins, csum_start, and where the result must be written, csum_start plus csum_offset. Those fields therefore control a write location, not just the checksum's numerical value. That distinction explains why malformed metadata can damage a header rather than merely produce a packet with an incorrect checksum. 2 3
The official CVE record supplies a concrete exposure path missing from the short release notice. A malicious microVM sends crafted virtio-net checksum metadata with an outbound frame. The virtual machine monitor passes it to the host's TAP interface; tun_get_user() feeds the packet into IPv4 processing, and fragmentation calls skb_checksum_help(). The record explicitly describes this as a guest/local virtual-device path, not an Internet receive path. Consequently, the relevant boundary in this scenario is between an untrusted guest and its host, not simply between transmit and receive traffic. 6
The dangerous ordering is that checksum completion can modify a header already validated by earlier processing. The CVE record describes the IPv4 header-length field changing, after which fragmentation trusts the new length and copies host memory into transmitted IPv4 options. The fix validates checksum_start before completing the checksum. The announcement calls this defense in depth and says fuller validation at input still needs work; it does not describe the exact check or invalid-packet handling. 6 3
As retrieved October 16, the Linux kernel CVE team's assessment is CVSS 3.1 9.3 Critical, with a local attack vector. Local does not mean harmless to a hosting operator: the official record reports demonstrated host-memory leakage, crashes and administrator code execution crossing guest-to-host isolation. These are reported demonstrations, separate from the severity score and from evidence of attacks in production. They support reviewing microVM hosting paths, but do not establish that every virtualization configuration is exploitable. 3 6
For remediation planning, the kernel CVE team recommends a complete stable update rather than an isolated cherry-pick, because fixes are tested as part of releases. For distribution-managed systems, request the vendor's fixed package build and verify the running kernel separately from installed packages. The reason to avoid a base-version-only judgment is backporting: vendor trees can carry selected upstream patches without adopting the corresponding upstream release number. The supplied sources do not identify distribution-specific fixed packages. 3 4
The CISA lookup retrieved October 16, using its October 15 catalog snapshot, does not list CVE-2026-99999. That is not proof that exploitation has not occurred. The kernel announcement reports independent reproduction, while the official record describes demonstrations; neither establishes exploitation in the wild. Catalog status should therefore remain separate from both the demonstrated guest-to-host consequences and the Critical severity assessment. 7 3 6