CVE-2026-99999: Input Validation Flaw (CVSS 9.3)

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Is your site exposed to CVE-2026-99999?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.3

CRITICAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0079

Probability of exploitation

0.57%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-20 Improper Input Validation

References

Other References

https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822 https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956 https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326 https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0 https://pwn.ai/blog/pwnescape https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge

Frequently Asked Questions

What is CVE-2026-99999? +

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. It has a CVSS v3.1 base score of 9.3 (CRITICAL).

How severe is CVE-2026-99999? +

CVE-2026-99999 has a CVSS v3.1 score of 9.3 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0079, placing it in the 1th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-99999? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-13826

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is …

CVE-2026-62658

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to …

CVE-2024-54011

Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in …

CVE-2026-54700

ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser …

CVE-2026-56349

n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail …

CVE-2026-6409

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured …

CVE-2026-99999