Origin validation error in Linux kernel - CVE-2026-99123
Published: October 29, 2026
Vulnerability identifier: #VU158477
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99123
CWE-ID: CWE-346
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to inject attacker-chosen data into another process's AF_VSOCK connection.
The vulnerability exists due to improper validation of packet source addresses in virtio_transport_recv_pkt() when matching incoming packets through the destination-only bound-socket lookup. A local user can send a RESPONSE packet from an unrelated source to a socket in TCP_SYN_SENT to transition it to TCP_ESTABLISHED, then send RW packets through the same fallback to inject data despite the socket retaining its intended peer address.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99123
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2