CVE-2026-99077 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv4: udp: Create exceptions before socket matching
Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP packet to an existing socket.
This behavior allows off-path attackers to conduct a side-channel attack on the FNHE cache in order to discover the ephemeral port used by a connected UDP socket.
Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the FNHE cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed.
Instead, mitigate such attacks by always creating a FNHE, even before trying to find a matching socket. Do that by calling ipv4_update_pmtu() and ipv4_redirect(), the helpers used when the quoted packet did not originate from a socket.
This means that guesses (right or wrong) from an off-path attacker will always result in a FNHE being created or updated in the cache that the attacker can observe.
Pass an oif of 0, in a similar fashion to icmp_err(). This is also the oif used by the socket path for sockets that are not bound to a device.
Note that this does not allow attackers to create FNHEs that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMP error that quotes an ICMP Echo Reply or one that quotes a UDP source port that matches a wildcard socket.
Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ipv4_sk_update_pmtu() / ipv4_sk_redirect(). When the two resolve to different nexthops, it also results in two exceptions being created for the same destination IP. One in the FNHE cache of the nexthop resolved by the no socket helpers and another in the FNHE cache of the nexthop used by the socket.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel contains a vulnerability related to how Internet Control Message Protocol (ICMP) error messages, specifically Fragmentation Needed and Redirect packets, are processed when they quote UDP datagrams that were not originally sent from an existing local socket. The core technical flaw lies in the conditional creation of Forwarding Information Base nexthop exceptions, or FNHEs. Under normal operation, these exceptions are cached to optimize subsequent routing decisions for traffic destined to a specific endpoint. However, the kernel currently only creates an FNHE if it can successfully match the quoted UDP packet to an existing socket on the local system. This conditional logic introduces a side-channel vulnerability that allows off-path attackers to perform reconnaissance against ephemeral port usage of connected UDP sockets. By sending crafted ICMP error messages with varying source ports and observing whether an exception is created in the cache, an attacker can infer which ports are actively used by applications, effectively bypassing previous mitigations such as randomized hash bucket sizes or improved hashing algorithms like siphash that were intended to obscure these patterns.
This vulnerability aligns with CWE-209, which describes the generation of an observable side-channel through timing or resource usage differences, and falls under MITRE ATT&CK technique T1564, specifically hiding execution artifacts via process injection or cache manipulation techniques where the attacker leverages system state changes to gather intelligence. The ability to detect whether a socket exists based on network stack behavior compromises the confidentiality of ephemeral port assignments, which are often used for short-lived connections and can aid in further exploitation attempts by revealing active services or internal communication patterns that should remain opaque to external observers. Although previous kernel commits attempted to mitigate this by randomizing exception cache structures and improving hash functions, these measures proved insufficient because they did not address the fundamental binary nature of the FNHE creation decision based on socket existence.
The resolution involves modifying the ICMP error handling logic in the IPv4 stack to always create an FNHE regardless of whether a matching socket is found. This is achieved by invoking helper functions such as ipv4_update_pmtu and ipv4_redirect, which are designed for cases where the quoted packet did not originate from a local socket. By ensuring that every guess made by an attacker results in either the creation or update of an FNHE entry, the side-channel signal is eliminated because the observable system state change occurs uniformly across all attempts. The implementation passes a zero output interface identifier to these helpers, mirroring the behavior for unbound sockets and maintaining consistency with existing error handling paths like icmp_err. This approach ensures that the network stack treats ICMP errors quoting non-local packets similarly to those quoting local ones regarding cache population, thereby removing the distinguishable difference between successful socket matches and misses.
While this fix effectively neutralizes the side-channel attack vector, it introduces minor performance implications in specific scenarios. In cases where a matching socket does exist, the system now performs an additional route lookup because the no-socket helpers execute their own routing resolution before the standard socket-based update functions run. If these two lookups resolve to different nexthops, the kernel may create duplicate FNHE entries for the same destination IP address, one in each respective cache path. Despite this slight increase in computational overhead and potential cache bloat, the security benefit of eliminating the information leakage outweighs the performance cost. The fix does not expand the attack surface by allowing attackers to create exceptions they could not previously generate, as both helper functions were already accessible with minimal validation constraints through other vectors such as ICMP Echo Replies or wildcard socket matches.