Introduction
CVE-2026-99999 is an out-of-bounds write vulnerability in the Linux kernel's IPv4 networking subsystem. A flaw in the skb_checksum_help function allows a local attacker or untrusted guest VM to send packets with malformed checksum metadata, corrupting memory in the network header. Successful exploitation can lead to arbitrary code execution, a denial-of-service crash, or disclosure of sensitive kernel memory.
The vulnerability carries a CVSS v3.1 score of 8.8 (local access, changed scope) and is classified as CWE-787 (Out-of-bounds Write). The upstream fix adds validation of checksum_start before the checksum is completed.
This article covers Rocky Linux 8, 9, and 10 systems, including CIQ LTS, FIPS, and RLC Pro variants. It describes what is affected, the current patch status, and recommended actions.
Problem
The IPv4 networking subsystem in the Linux kernel does not validate the checksum_start offset before completing a checksum operation. A packet with crafted checksum metadata can reach skb_checksum_help, which then writes beyond the bounds of the network header, corrupting adjacent kernel memory. This corruption can be leveraged for code execution, crashing the kernel (DoS), or leaking kernel memory contents.
The following systems should be treated as affected until running a patched kernel listed in the Patched Kernels section:
- Rocky Linux 8, 9, and 10 community releases
- Rocky Linux 8 and 9 LTS variants
- RLC Pro FIPS variants
- RLC Pro variants based on Rocky Linux 8, 9, or 10 including RLC Pro Hardened
The vulnerability requires local code execution or the ability to inject packets from an untrusted guest VM. It is not exploitable by remote unauthenticated attackers sending traffic to a listening service. However, any system with local shell users, shared application accounts, CI runners, KVM guests running untrusted workloads, or containerized workloads that allow packet injection should be treated as exposed.
Status
- No patched kernels are available as of 2026-10-16. CIQ engineering is tracking the upstream fix and will build patched kernels for all supported variants once the fix is merged to stable branches. This article will be updated as builds complete validation.
- No mitigation is currently available. The vulnerable code path is in the core IPv4 networking stack and cannot be disabled via module blocking, sysctl, or firewall rules without breaking network connectivity entirely.
- Recommended action: monitor this article for patched kernel availability. When a patched kernel is released for your variant, install it with
sudo dnf update kernel*and reboot. - CIQ Bridge customers should open a support case for guidance on whether their kernel version is affected.
- For Rocky Linux community releases, refer to Rocky Linux Errata for patched kernel availability and update instructions.
- Open a support case if you need help assessing exposure or tracking patched kernel availability for a specific CIQ variant.
Patched Kernels
No patched kernels are available as of 2026-10-16.
| Variant | Patched Kernel Version | Released |
|---|
This table will be updated as CIQ engineering releases validated kernel builds for each variant.
Confirm what is running on a given system with:
uname -r
Notes
Before the patched kernel is available, consider the following risk-limiting measures:
- Attack surface: the vulnerability requires local code execution or the ability to send packets with crafted checksum metadata from within a KVM guest. Systems with no local users, no untrusted guest VMs, and no containerized workloads that allow raw packet construction have a reduced attack surface, though patching remains the recommended action.
- No module-level mitigation: unlike vulnerabilities in optional kernel modules (such as
esp4orrxrpc), the IPv4 checksum path is part of the core networking stack. It cannot be disabled without breaking all IPv4 connectivity. - Exploitation: the vulnerability has been reproduced independently. Treat affected systems with local users or untrusted workloads as exploitable until a patched kernel is installed.