CVE-2026-99064 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
cipso: adjust cached option offsets when removing CIPSO
cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them.
For example, with a valid 10-byte CIPSO option followed by a seven-byte RR option, parsing records rr at offset 30. Removing CIPSO moves RR to offset 20, while the cached offset remains 30. Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes; the latter may interpret packet data as the option length and copy it into fixed-size option storage.
Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and router_alert offsets when they follow CIPSO. cipso_len is the distance the first memmove() shifts those options. The later header move and network-header reset relocate the bytes and their offset base together.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel contains a critical vulnerability within the Control-Plane Integrity Protocol (CIPSO) implementation, specifically in the function cipso_v4_skbuff_delattr which is responsible for removing CIPSO options from packet headers. This flaw arises because the removal process correctly shifts the remaining header data to fill the gap left by the deleted option but fails to update the cached offset values associated with subsequent network layer options such as Record Route (RR), Strict Source Routing (SRR), Timestamps, and Router Alert. When a CIPSO option is removed from an IP packet header, the underlying bytes are moved backward in memory via memmove operations to maintain contiguous header structure. However, the kernel maintains internal pointers or offset variables that track where specific options begin within the header buffer. If these cached offsets are not decremented by the length of the removed CIPSO option, they continue to point to positions relative to the original, pre-removal layout rather than the new post-removal layout.
This desynchronization between actual data placement and recorded metadata leads to severe memory safety violations when subsequent kernel functions attempt to parse or process these options. Functions such as ip_forward_options and __ip_options_echo rely on these cached offsets to locate option headers within the packet buffer. Because the offsets remain stale, these functions access incorrect byte ranges in the network header. In particular, this misalignment can cause the parser to interpret arbitrary payload data or subsequent protocol fields as valid option length values. For instance, if a Record Route option follows a CIPSO option and its cached offset is not adjusted, __ip_options_echo may read garbage data from an unrelated part of the packet buffer and treat it as the length field for that option.
The operational impact of this vulnerability includes potential kernel memory corruption and arbitrary code execution with kernel privileges. When the parser uses incorrect data to determine how many bytes to copy into fixed-size option storage structures, it can trigger a heap-based or stack-based buffer overflow if the interpreted length exceeds the allocated space. This allows an attacker who can influence packet headers containing CIPSO options followed by other IP options to exploit this logic error during normal network processing paths such as forwarding or echo request handling. The vulnerability effectively bypasses standard bounds checking mechanisms because the check is performed against a corrupted length value derived from misaligned memory access rather than actual option boundaries.
From a classification perspective, this issue aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write depending on whether the incorrect offset leads to reading sensitive kernel memory or writing beyond buffer limits during copy operations. In terms of attack vectors, it relates to ATT&CK technique T1068 Exploitation for Privilege Escalation if an attacker leverages this flaw to gain higher system privileges from a lower-privileged context such as network packet processing threads. The vulnerability highlights the complexity and fragility involved in managing variable-length header options within high-performance networking stacks where manual memory management is required.
Mitigation strategies primarily involve applying vendor-provided kernel patches that correct the offset adjustment logic in cipso_v4_skbuff_delattr. Developers must ensure that whenever an option is removed from a packet header, all subsequent cached offsets for SRR, RR, TS, and router_alert are decremented by the length of the removed CIPSO option. This ensures consistency between physical memory layout and logical metadata pointers. Additionally, implementing stricter validation checks in __ip_options_echo to verify that interpreted lengths do not exceed remaining buffer bounds before copying data can provide defense-in-depth against similar off-by-one or misalignment errors. System administrators should prioritize updating kernel packages on affected systems to eliminate the risk of remote exploitation through crafted network traffic containing mixed IP options.