CVE-2026-99076

A flaw was found in the Linux kernel's IPv6 UDP implementation. This flaw allows information disclosure through a side-channel vulnerability in the routing exception cache. An off-path remote attacker can exploit this flaw by sending crafted Internet Control Message Protocol version 6 (ICMPv6) error messages that quote User Datagram Protocol (UDP) packets. By observing how routing exceptions are created, the attacker can deduce the ephemeral port numbers used by connected network sockets.

This vulnerability is rated as Low severity because successful exploitation is constrained to leaking ephemeral source ports of connected UDP sessions and requires high attack complexity through side-channel probing. An off-path adversary can infer port assignments only by observing state changes in IPv6 route exceptions elicited by spoofed control messages. The flaw does not grant unauthorized access to network payloads, provide system privileges, or compromise kernel stability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.