CVE-2026-99030 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent.
Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel vulnerability identified in the net: skbuff subsystem involves a critical information disclosure flaw within the skb_copy_and_csum_bits function. This issue arises when the function processes network buffers that contain fragments which are unreadable or inaccessible due to memory constraints or other internal state issues. Under normal operation, this function is responsible for copying data from scattered buffer segments into a contiguous linear area while simultaneously computing checksums for transmission integrity verification. However, when the processing logic encounters these unreadable fragments, it prematurely terminates the copy operation after handling only the accessible linear portion of the packet. Crucially, the implementation fails to clear or initialize the remaining unused space in the destination buffer that was not overwritten by the partial data transfer.
This oversight leads to a significant security risk classified under CWE-200 as an Information Exposure vulnerability and aligns with ATT&CK technique T1567.002 for Exfiltration Over Alternative Protocol if such packets are successfully transmitted. The destination buffer in question is typically destined for immediate network transmission, serving either as the payload for ICMP error messages that quote offending packets or as a transmit bounce buffer within driver-specific implementations like skb_copy_and_csum_dev. Because these buffers are allocated from kernel memory pools without being zeroed out prior to use, they may contain residual data from previous allocations. This stale memory content can include sensitive information such as cryptographic keys, session tokens, user credentials, or other private kernel structures that were previously stored in those memory locations and not securely wiped after their original usage.
The operational impact of this vulnerability is severe because it allows an attacker to potentially exfiltrate arbitrary kernel memory contents over the network. Although the checksum calculation will likely fail due to the mismatch between the actual data copied and the stale bytes remaining in the buffer, resulting in packet drops by receivers, the mere act of transmitting uninitialized memory poses a risk. In some scenarios, if the application layer or lower-level drivers perform additional processing before transmission that might mask the checksum error, or if the attacker can influence which specific kernel pages are reused for these buffers, they could systematically probe and extract sensitive data. This constitutes an unauthorized information leak from the privileged kernel space to untrusted network endpoints, violating fundamental confidentiality principles in system architecture.
To mitigate this vulnerability, developers must ensure that any portion of a buffer allocated for transmission is explicitly zeroed out before being populated with new packet data. The fix involves modifying skb_copy_and_csum_bits to perform a memset operation on the unused tail end of the destination buffer when partial copying occurs due to unreadable fragments. This ensures that no residual kernel memory content is transmitted over the network interface. Furthermore, it is essential to handle edge cases carefully; specifically, the zeroing logic must only apply when there are positive bytes remaining to be cleared. If a negative length value indicates an error condition from a broken caller, attempting to clear such a large or invalid range could lead to kernel panics or other stability issues due to out-of-bounds memory access. Therefore, conditional checks must guard the memset operation to prevent turning input errors into denial of service vectors while still addressing the information disclosure flaw in valid operational paths.