CVE-2026-99077

A flaw was found in the Linux kernel's IPv4 User Datagram Protocol (UDP) implementation. When handling Internet Control Message Protocol (ICMP) error messages, routing exceptions were only recorded in the cache if the quoted UDP packet matched an existing active socket. An off-path remote attacker could exploit this side channel by sending forged ICMP packets and observing cache behavior, leading to information disclosure of ephemeral port numbers used by connected UDP sockets. Exposing these active port numbers can assist attackers in conducting subsequent network spoofing or traffic manipulation attacks.

This vulnerability is rated as Low severity on Red Hat Enterprise Linux because it represents an information-disclosure side channel that requires high attack complexity and precise timing to exploit, without directly enabling host compromise or denial of service. While Red Hat systems handle UDP traffic and process incoming ICMP error messages by default, an off-path attacker must accurately probe active, connected sockets while navigating routing cache noise. Even if ephemeral port numbers are uncovered, exploitation remains limited to facilitating blind spoofing against specific protocols, where standard defenses such as transaction ID randomization and DNSSEC further restrict overall impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.