SB20261023123 - Use of uninitialized resource in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-99030)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain potentially sensitive information from stale kernel memory transmitted in outgoing packets.

The vulnerability exists due to use of uninitialized buffer contents in skb_copy_and_csum_bits() when encountering unreadable packet fragments after copying only the linear portion of a packet. A remote attacker can inspect affected outgoing ICMP error messages or driver transmissions to obtain stale memory contents from portions of the destination buffer that were not filled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/39d1a6b601831237c6038b5e3ac8dbb883c1700a
• https://git.kernel.org/stable/c/5551399751e2c9f31e4f3428040985a07e79d9c2
• https://git.kernel.org/stable/c/5f19b9cfff79508e8cb09be40d014cb0807f3854
• https://git.kernel.org/stable/c/ab9414ed70bd783e902a85c350620dee269bcb2b