{"cve":"CVE-2026-99999","nvd":{"published":"2026-10-15T13:17:14.137","modified":"2026-10-19T22:17:28.667","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":9.3},"cwes":["CWE-20"],"references":["https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a","https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb","https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822","https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf","https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-99999","score":0.00788,"percentile":0.55907,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}