CVE-2026-99030
kernel: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 23, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel. An information disclosure vulnerability exists where the network subsystem fails to properly clear packet buffers when handling unreadable fragments. When copying packet data, the kernel can leave stale memory in buffers that are subsequently transmitted over the network. An attacker could exploit this flaw to inspect outbound network packets and expose uninitialized kernel memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-908 · Use of Uninitialized Resource