Observable discrepancy in Linux kernel - CVE-2026-99077
Published: October 23, 2026
Vulnerability identifier: #VU157430
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99077
CWE-ID: CWE-203
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to discover the ephemeral port used by a connected UDP socket through a cache side channel.
The vulnerability exists due to an observable discrepancy in IPv4 UDP error handling in the Linux kernel when processing locally delivered ICMP Fragmentation Needed or Redirect messages that quote UDP packets. A remote attacker can send crafted ICMP messages containing guessed UDP ports and observe changes in the FIB nexthop exception (FNHE) cache to distinguish packets matching an existing socket and discover its ephemeral port.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99077
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2