Integer overflow in Linux kernel - CVE-2026-99191
Published: October 29, 2026
Vulnerability identifier: #VU158382
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99191
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause incorrect IPv6 payload-length reporting, potentially disrupting packet processing by nf_tables, conntrack and sch_cake.
The vulnerability exists due to integer wraparound and incorrect handling of the zero payload-length marker in calipso_skbuff_setattr() when inserting or resizing CALIPSO options on IPv6 packets forwarded to a destination mapped to CALIPSO. A remote attacker can send traffic that forms oversized aggregated packets or crosses the IPv6 payload-length limit during labeling to cause downstream components to use an incorrect payload length.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99191
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2