SB20261023104 - Race condition in Linux kernel net wireguard driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023104

SB20261023104 - Race condition in Linux kernel net wireguard driver

Published: October 23, 2026

Security Bulletin ID SB20261023104
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Race condition (CVE-ID: CVE-2026-99059)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause WireGuard to establish the same cryptographic session more than once.

The vulnerability exists due to a race condition in WireGuard's Noise handshake processing when duplicate handshake responses are processed concurrently with an intervening handshake initiation. A remote attacker can replay a handshake response under this timing condition to cause stale handshake state to be accepted and the same session to be established more than once.


Remediation

Install update from vendor's website.

References