CVE-2026-99064

A flaw was found in the Linux kernel. When removing Commercial IP Security Option (CIPSO) attributes from a network packet, the kernel does not adjust the cached offsets of subsequent IP options. A remote attacker could exploit this vulnerability by sending specially crafted IPv4 packets, causing the system to read incorrect packet data and copy it into fixed-size memory buffers. This flaw can result in memory corruption or a Denial of Service (DoS).

This vulnerability is rated as having an Important severity because it enables unauthenticated remote attackers to trigger kernel memory corruption or cause a system crash through malformed network traffic, without requiring local privileges. Under default Red Hat Enterprise Linux configurations, labeled networking via CIPSO is not actively utilized unless multi-level security (MLS) or explicit NetLabel packet tagging policies are configured. However, systems receiving or forwarding IPv4 packets carrying CIPSO attributes alongside additional options remain exposed to offset desynchronization during option stripping, elevating the potential blast radius to kernel compromise or host instability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to synchronize cached IP option offsets after removing CIPSO attributes in the Linux kernel network stack to prevent out-of-bounds writes into fixed-size option storage: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which subtract cipso_len from srr, rr, ts, and router_alert cached offsets when removing CIPSO attributes, closing crafted IPv4 packet containing CIPSO attributes followed by secondary IP options. Until patched, this is only a concern on Linux systems configured to process or forward IPv4 packets with CIPSO attributes — Non-Linux platforms are unaffected — so Filter or strip inbound IPv4 packets carrying CIPSO attributes and secondary IP options at the network perimeter before they reach vulnerable kernel packet processing paths. As a compensating measure, Enable runtime memory error detection such as KASAN or HWASan to detect out-of-bounds writes into kernel option buffers caused by reading packet data at desynchronized IP option offsets. These controls limit blast radius and contain exploitation, but they do not fix the underlying stale cached IP option offset defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)