Race condition in Linux kernel - CVE-2026-99059

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU157446

Race condition in Linux kernel - CVE-2026-99059

Published: October 23, 2026


Vulnerability identifier: #VU157446
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99059
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause WireGuard to establish the same cryptographic session more than once.

The vulnerability exists due to a race condition in WireGuard's Noise handshake processing when duplicate handshake responses are processed concurrently with an intervening handshake initiation. A remote attacker can replay a handshake response under this timing condition to cause stale handshake state to be accepted and the same session to be established more than once.


Affected software

Linux kernel
openEuler
Ubuntu
linux (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-raspi (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-realtime (Ubuntu package)
linux-lowlatency-hwe-6.8 (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-azure-6.8 (Ubuntu package)
linux-oracle-6.8 (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-gke (Ubuntu package)
linux-vmware (Ubuntu package)
linux-ibm-6.8 (Ubuntu package)
linux-gcp-6.8 (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-raspi-realtime (Ubuntu package)
linux-realtime-6.8 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-azure-fde-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-aws-7.0 (Ubuntu package)
kernel-source
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-tools
kernel-debugsource
kernel-tools-debuginfo
kernel-devel
perf
kernel-headers
perf-debuginfo
python3-perf
python3-perf-debuginfo
kernel-tools-devel

How to mitigate CVE-2026-99059

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 6.8.0-149.149, 7.0.0-43.43
linux-lowlatency (Ubuntu package) - update to 6.8.0-149.149.1
linux-raspi (Ubuntu package) - addressed in versions 6.8.0-1068.72, 7.0.0-1023.23
linux-gcp (Ubuntu package) - addressed in versions 6.8.0-1073.81, 7.0.0-1017.19
linux-azure (Ubuntu package) - addressed in versions 6.8.0-1073.82, 7.0.0-1020.21
linux-aws (Ubuntu package) - addressed in versions 6.8.0-1069.74, 7.0.0-1017.18
linux-ibm (Ubuntu package) - addressed in versions 6.8.0-1069.70, 7.0.0-1018.18
linux-oracle (Ubuntu package) - addressed in versions 6.8.0-1067.71, 7.0.0-1016.18
linux-nvidia (Ubuntu package) - update to 6.8.0-1067.70
linux-realtime (Ubuntu package) - addressed in versions 6.8.1-1064.65, 7.0.0-43.43.1
linux-lowlatency-hwe-6.8 (Ubuntu package) - update to 6.8.0-149.149.1~22.04.1
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1071.78~22.04.1
linux-azure-6.8 (Ubuntu package) - update to 6.8.0-1073.82~22.04.1
linux-oracle-6.8 (Ubuntu package) - update to 6.8.0-1067.71~22.04.1
linux-aws-6.8 (Ubuntu package) - update to 6.8.0-1069.74~22.04.1
linux-gkeop (Ubuntu package) - update to 6.8.0-1053.57
linux-gke (Ubuntu package) - addressed in versions 6.8.0-1068.77, 7.0.0-1010.11
linux-vmware (Ubuntu package) - update to 6.8.0-1010.10
linux-ibm-6.8 (Ubuntu package) - update to 6.8.0-1069.70~22.04.1
linux-gcp-6.8 (Ubuntu package) - update to 6.8.0-1073.81~22.04.1
linux-aws-fips (Ubuntu package) - update to 6.8.0-1069.74+fips1
linux-gcp-fips (Ubuntu package) - update to 6.8.0-1073.81+fips1
linux-azure-fips (Ubuntu package) - update to 6.8.0-1073.82+fips1
linux-raspi-realtime (Ubuntu package) - update to 6.8.0-2056.58
linux-realtime-6.8 (Ubuntu package) - update to 6.8.1-1064.65~22.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1016.18~24.04.1
linux-azure-fde-7.0 (Ubuntu package) - update to 7.0.0-1019.19~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1017.19~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1018.18
linux-azure-fde (Ubuntu package) - update to 7.0.0-1019.19
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1017.18~24.04.1
kernel-source - update to 5.10.0-341.0.0.242
kernel - update to 5.10.0-341.0.0.242
bpftool - update to 5.10.0-341.0.0.242
bpftool-debuginfo - update to 5.10.0-341.0.0.242
kernel-debuginfo - update to 5.10.0-341.0.0.242
kernel-tools - update to 5.10.0-341.0.0.242
kernel-debugsource - update to 5.10.0-341.0.0.242
kernel-tools-debuginfo - update to 5.10.0-341.0.0.242
kernel-devel - update to 5.10.0-341.0.0.242
perf - update to 5.10.0-341.0.0.242
kernel-headers - update to 5.10.0-341.0.0.242
perf-debuginfo - update to 5.10.0-341.0.0.242
python3-perf - update to 5.10.0-341.0.0.242
python3-perf-debuginfo - update to 5.10.0-341.0.0.242
kernel-tools-devel - update to 5.10.0-341.0.0.242

External References

Related Security Bulletins